sheetrat | c6694c1a76fa191ff75af8a391961ef51c023cdb672173836bb579a6db36526e

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
brabus.exe
Size 354KB
Sample260722-lesszadb44
SHA256 c6694c1a76fa191ff75af8a391961ef51c023cdb672173836bb579a6db36526e
MD5 d6677bcf68ce431e572140de44c61b73
SHA1 f8b3fb666f1955df14c205f81ac81de18de447a2
SHA512 0be82f17cf0d9362542f8bb8c3f2840011be55d028ceb4de268e211e0c3a84c350776c33e4fd50941a85f62990191c820f5db6a1c4ae28aa8d93ddadd65e070b
SSDEEP 6144:1PpsHzYDAJa130l4lywxQLaZcK2nBggxNjDVbFWh3UeN:1o6sKaggxxni3UeN
TLSH
T16074920CFE91F805DE1A3EB7CAE618105B7120C22F119256315AAFFD875A37758E26BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_mlqxvdlobvxqeu execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Campaign

Sheet_mlqxvdlobvxqeu

tcp.niceports.shop:20000

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/2368-1-0x00000000006F0000-0x000000000074E000-memory.dmp	family_sheetrat_v4
behavioral2/files/0x000e00000001c504-11.dat	family_sheetrat_v4

Detects Sheetrat obfuscated version 2 IoCs

resource	yara_rule
behavioral2/memory/2368-1-0x00000000006F0000-0x000000000074E000-memory.dmp	Sheetrat_v5
behavioral2/files/0x000e00000001c504-11.dat	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdCorelDRAW.exe"	brabus.exe

Executes dropped EXE 4 IoCs

pid	Process
5056	xdwdCorelDRAW.exe
2612	xdwdOBS Studio Update.exe
4260	xdwdCorelDRAW.exe
3524	36c3663f-0dec-420e-8b88-ea283cd5fd7a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\pidoras = "C:\\Users\\Public\\Pictures\\xdwdOBS Studio Update.exe"	brabus.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
13	raw.githubusercontent.com

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	icanhazip.com
1	ipinfo.io
2	api.ipify.org
5	api.ipify.org
14	ipinfo.io
19	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 49 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4512	CMD.exe
5808	CMD.exe
3320	CMD.exe
4324	CMD.exe
2468	CMD.exe
4916	CMD.exe
1136	CMD.exe
2876	CMD.exe
3028	CMD.exe
4292	CMD.exe
4076	CMD.exe
5972	CMD.exe
5424	CMD.exe
3400	CMD.exe
5584	CMD.exe
2232	CMD.exe
1388	CMD.exe
752	CMD.exe
1200	CMD.exe
4496	CMD.exe
4068	CMD.exe
1868	CMD.exe
3312	CMD.exe
3508	CMD.exe
5684	CMD.exe
4116	CMD.exe
1732	CMD.exe
4772	CMD.exe
5440	CMD.exe
4060	CMD.exe
4672	CMD.exe
4856	CMD.exe
5488	CMD.exe
5080	CMD.exe
3068	CMD.exe
1364	CMD.exe
5688	CMD.exe
4524	CMD.exe
5812	CMD.exe
3156	CMD.exe
2116	CMD.exe
5576	CMD.exe
4908	CMD.exe
3604	CMD.exe
1080	CMD.exe
5492	CMD.exe
2252	CMD.exe
5368	CMD.exe
4052	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 49 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
260	schtasks.exe
5816	schtasks.exe
1000	schtasks.exe
1924	schtasks.exe
6068	schtasks.exe
1712	schtasks.exe
5444	schtasks.exe
4320	schtasks.exe
5940	schtasks.exe
3960	schtasks.exe
1796	schtasks.exe
4860	schtasks.exe
4584	schtasks.exe
4500	schtasks.exe
2156	schtasks.exe
5464	schtasks.exe
1708	schtasks.exe
3584	schtasks.exe
5616	schtasks.exe
2916	schtasks.exe
5792	schtasks.exe
2756	schtasks.exe
4344	schtasks.exe
5020	schtasks.exe
2728	schtasks.exe
1148	schtasks.exe
1916	schtasks.exe
1376	schtasks.exe
2868	schtasks.exe
4284	schtasks.exe
3892	schtasks.exe
4500	schtasks.exe
2440	schtasks.exe
6020	schtasks.exe
1316	schtasks.exe
2388	schtasks.exe
5348	schtasks.exe
3304	schtasks.exe
4904	schtasks.exe
4380	schtasks.exe
2236	schtasks.exe
5848	schtasks.exe
4644	schtasks.exe
2592	schtasks.exe
1092	schtasks.exe
5020	schtasks.exe
3360	schtasks.exe
6000	schtasks.exe
5956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2368	brabus.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe
2612	xdwdOBS Studio Update.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	brabus.exe
Token: SeDebugPrivilege	5056	xdwdCorelDRAW.exe
Token: SeDebugPrivilege	2612	xdwdOBS Studio Update.exe
Token: SeDebugPrivilege	4260	xdwdCorelDRAW.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3068	2368	brabus.exe	90
PID 3068 wrote to memory of 260	3068	CMD.exe	92
PID 2368 wrote to memory of 5492	2368	brabus.exe	93
PID 5492 wrote to memory of 2868	5492	CMD.exe	96
PID 2368 wrote to memory of 2252	2368	brabus.exe	97
PID 2252 wrote to memory of 3960	2252	CMD.exe	100
PID 2368 wrote to memory of 3028	2368	brabus.exe	106
PID 3028 wrote to memory of 1708	3028	CMD.exe	108
PID 2368 wrote to memory of 1364	2368	brabus.exe	111
PID 1364 wrote to memory of 3584	1364	CMD.exe	113
PID 2368 wrote to memory of 1868	2368	brabus.exe	115
PID 1868 wrote to memory of 4284	1868	CMD.exe	117
PID 2368 wrote to memory of 5688	2368	brabus.exe	119
PID 5688 wrote to memory of 5816	5688	CMD.exe	121
PID 5056 wrote to memory of 5440	5056	xdwdCorelDRAW.exe	122
PID 5440 wrote to memory of 4344	5440	CMD.exe	124
PID 2368 wrote to memory of 5584	2368	brabus.exe	125
PID 5584 wrote to memory of 5020	5584	CMD.exe	127
PID 5056 wrote to memory of 3320	5056	xdwdCorelDRAW.exe	128
PID 3320 wrote to memory of 5616	3320	CMD.exe	130
PID 2368 wrote to memory of 4060	2368	brabus.exe	131
PID 4060 wrote to memory of 1796	4060	CMD.exe	133
PID 2368 wrote to memory of 5368	2368	brabus.exe	134
PID 5368 wrote to memory of 3360	5368	CMD.exe	136
PID 2368 wrote to memory of 1080	2368	brabus.exe	137
PID 1080 wrote to memory of 3892	1080	CMD.exe	139
PID 2612 wrote to memory of 4324	2612	xdwdOBS Studio Update.exe	140
PID 4324 wrote to memory of 4860	4324	CMD.exe	142
PID 2368 wrote to memory of 2232	2368	brabus.exe	143
PID 2232 wrote to memory of 4500	2232	CMD.exe	145
PID 2612 wrote to memory of 4260	2612	xdwdOBS Studio Update.exe	146
PID 2368 wrote to memory of 4292	2368	brabus.exe	147
PID 4292 wrote to memory of 1000	4292	CMD.exe	149
PID 2368 wrote to memory of 4052	2368	brabus.exe	150
PID 4052 wrote to memory of 3304	4052	CMD.exe	152
PID 2368 wrote to memory of 3312	2368	brabus.exe	153
PID 3312 wrote to memory of 1924	3312	CMD.exe	155
PID 2368 wrote to memory of 3508	2368	brabus.exe	156
PID 3508 wrote to memory of 4904	3508	CMD.exe	158
PID 2368 wrote to memory of 1388	2368	brabus.exe	159
PID 1388 wrote to memory of 4584	1388	CMD.exe	161
PID 2368 wrote to memory of 3524	2368	brabus.exe	162
PID 2368 wrote to memory of 5684	2368	brabus.exe	164
PID 5684 wrote to memory of 2440	5684	CMD.exe	166
PID 2368 wrote to memory of 4672	2368	brabus.exe	167
PID 4672 wrote to memory of 4380	4672	CMD.exe	169
PID 2368 wrote to memory of 4524	2368	brabus.exe	170
PID 4524 wrote to memory of 5940	4524	CMD.exe	172
PID 2368 wrote to memory of 4076	2368	brabus.exe	173
PID 4076 wrote to memory of 5848	4076	CMD.exe	175
PID 2368 wrote to memory of 752	2368	brabus.exe	176
PID 752 wrote to memory of 4644	752	CMD.exe	178
PID 2368 wrote to memory of 5972	2368	brabus.exe	179
PID 5972 wrote to memory of 5348	5972	CMD.exe	181
PID 2368 wrote to memory of 2876	2368	brabus.exe	182
PID 2876 wrote to memory of 2916	2876	CMD.exe	184
PID 2368 wrote to memory of 4116	2368	brabus.exe	185
PID 4116 wrote to memory of 2592	4116	CMD.exe	187
PID 2368 wrote to memory of 4856	2368	brabus.exe	188
PID 4856 wrote to memory of 6000	4856	CMD.exe	190
PID 2368 wrote to memory of 5424	2368	brabus.exe	191
PID 5424 wrote to memory of 4500	5424	CMD.exe	193
PID 4260 wrote to memory of 2468	4260	xdwdCorelDRAW.exe	194
PID 2468 wrote to memory of 2728	2468	CMD.exe	196

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\brabus.exe
"C:\Users\Admin\AppData\Local\Temp\brabus.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Quicken" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Quicken" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Flight Simulator" /tr "C:\Users\Public\Pictures\xdwdOBS Studio Update.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Flight Simulator" /tr "C:\Users\Public\Pictures\xdwdOBS Studio Update.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4584
- C:\Users\Admin\AppData\Local\Temp\36c3663f-0dec-420e-8b88-ea283cd5fd7a.exe
  "C:\Users\Admin\AppData\Local\Temp\36c3663f-0dec-420e-8b88-ea283cd5fd7a.exe"
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5848
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1200
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1148
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5444
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5576
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4772
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2756

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5616

C:\Users\Public\Pictures\xdwdOBS Studio Update.exe
"C:\Users\Public\Pictures\xdwdOBS Studio Update.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2728
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5812
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwdCorelDRAW.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe
Size 354KB
SHA256 c6694c1a76fa191ff75af8a391961ef51c023cdb672173836bb579a6db36526e
MD5 d6677bcf68ce431e572140de44c61b73
SHA1 f8b3fb666f1955df14c205f81ac81de18de447a2
SHA512 0be82f17cf0d9362542f8bb8c3f2840011be55d028ceb4de268e211e0c3a84c350776c33e4fd50941a85f62990191c820f5db6a1c4ae28aa8d93ddadd65e070b
SSDEEP 6144:1PpsHzYDAJa130l4lywxQLaZcK2nBggxNjDVbFWh3UeN:1o6sKaggxxni3UeN
TLSH
T16074920CFE91F805DE1A3EB7CAE618105B7120C22F119256315AAFFD875A37758E26BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36c3663f-0dec-420e-8b88-ea283cd5fd7a.exe

Path C:\Users\Admin\AppData\Local\Temp\36c3663f-0dec-420e-8b88-ea283cd5fd7a.exe
Size 6KB
SHA256 7a600a83a82de3962bf9584f090fa96373ffc5e9fa0497612c72c5a42b5a5a70
MD5 83bcfff3796bb7a6340c8042e269ea8b
SHA1 7d6227c3a62e6cee127ea318651cbad6564dd92d
SHA512 a601a3e42f9978b0530a3a449e344824a31eabc19d8062da9108d8ee8c6717c4b133970360c14d9ea9116819a5241487c4f0923ac91356e379c4a5503bcd1373
SSDEEP 96:PoIFdEe/M3zsfZjvEvMDsOh5793fLSk+zNt:PFdtM3zEzRJ9xY
TLSH
T149C1BA0A93E80B27D8BA077419735765B7B4F11249B7476F34E4612AFE113A05A533F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2368-6-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/2368-3-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/2368-4-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/2368-5-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/2368-0-0x00007FFB78BCF000-0x00007FFB78BD0000-memory.dmp

Download

memory/2368-2-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/2368-39-0x000000001C110000-0x000000001C186000-memory.dmp

Download

memory/2368-40-0x0000000002880000-0x000000000288A000-memory.dmp

Download

memory/2368-41-0x00000000028D0000-0x00000000028EE000-memory.dmp

Download

memory/2368-44-0x0000000002890000-0x000000000289A000-memory.dmp

Download

memory/2368-1-0x00000000006F0000-0x000000000074E000-memory.dmp

Download

memory/3524-53-0x0000000000D80000-0x0000000000D88000-memory.dmp

Download