sheetrat | d9c9225729a1df9cba0ed9ad2a2028c836541ecb3668bc416d7767239c448743

Analysis

user interaction
yes
max time kernel
136s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TLaunche.exe
Size 221KB
Sample260805-ph2f3afn5v
SHA256 d9c9225729a1df9cba0ed9ad2a2028c836541ecb3668bc416d7767239c448743
MD5 d2225e059fce5f86f00b1923198ffadc
SHA1 87303a64cd5b123383bfd8949c4b9317a99e4ed1
SHA512 ed263d2076bc7d5be5056af86ecac9661e5377f18544644390dc4d73fb2ef2aa695938c48be3e0a452fdd85a36f02a8d6d80282a09c900f12614b067ed63eaa8
SSDEEP 1536:f5QdU6pya4+TeFiYtObodgXu5ibUivP1cIRlfPzVfNAR5bNOE2JDZ:fadXyUTeFhtObodS9hN2blE
TLSH
T17324E011AAFC3E63F81C1B3A6681434F27175B05C2AA7B582B4DB4B4219D9437F726BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

minecraft execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Minecraft

Steiker43-64323.portmap.host:64323

Mutex

Attributes

anti_virtual
false
certificate
3W0gYzczTy8yu3dLwHR0GjO50KnQ
exclusion_wd
false
hidden_file
true
install
true
install_watch_dog
false
key
F9eceekuErSTxnvEe
path_client
%UserProfile%\Sub\MalwareDef.exe
pump
false
rootkit
false
task_watch_dog
qHF6s3tJ0xurgh
use_install_admin
true
user_init
false

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4632-0-0x0000000000720000-0x000000000075E000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x000e00000001c586-12.dat	family_sheetrat_v1

Executes dropped EXE 63 IoCs

pid	Process
4832	MalwareDef.exe
4968	MalwareDef.exe
4772	MalwareDef.exe
2484	MalwareDef.exe
2832	MalwareDef.exe
52	MalwareDef.exe
5344	MalwareDef.exe
4892	MalwareDef.exe
4688	MalwareDef.exe
1504	MalwareDef.exe
1632	MalwareDef.exe
1220	MalwareDef.exe
2860	MalwareDef.exe
1968	MalwareDef.exe
2644	MalwareDef.exe
2316	MalwareDef.exe
3832	MalwareDef.exe
4136	MalwareDef.exe
5096	MalwareDef.exe
3960	MalwareDef.exe
4232	MalwareDef.exe
1716	MalwareDef.exe
5808	MalwareDef.exe
3604	MalwareDef.exe
728	MalwareDef.exe
5884	MalwareDef.exe
3208	MalwareDef.exe
2028	MalwareDef.exe
4508	MalwareDef.exe
4328	MalwareDef.exe
2968	MalwareDef.exe
2912	MalwareDef.exe
4936	MalwareDef.exe
2044	MalwareDef.exe
2960	MalwareDef.exe
2924	MalwareDef.exe
4276	MalwareDef.exe
1824	MalwareDef.exe
3516	MalwareDef.exe
3468	MalwareDef.exe
2764	MalwareDef.exe
5072	MalwareDef.exe
2572	MalwareDef.exe
4468	MalwareDef.exe
3948	MalwareDef.exe
5928	MalwareDef.exe
4132	MalwareDef.exe
6072	MalwareDef.exe
4896	MalwareDef.exe
4792	MalwareDef.exe
4140	MalwareDef.exe
5828	MalwareDef.exe
1132	MalwareDef.exe
5968	MalwareDef.exe
4928	MalwareDef.exe
832	MalwareDef.exe
5504	MalwareDef.exe
2272	MalwareDef.exe
5408	MalwareDef.exe
2904	MalwareDef.exe
2356	MalwareDef.exe
2056	MalwareDef.exe
1484	MalwareDef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4388	cmd.exe
6148	cmd.exe
6240	cmd.exe
5228	cmd.exe
1656	cmd.exe
3424	cmd.exe
1332	cmd.exe
4316	cmd.exe
2612	cmd.exe
3704	cmd.exe
3812	cmd.exe
5844	cmd.exe
6296	cmd.exe
5048	cmd.exe
3800	cmd.exe
5064	cmd.exe
6380	cmd.exe
3336	cmd.exe
1848	cmd.exe
1096	cmd.exe
2328	cmd.exe
5736	cmd.exe
1932	cmd.exe
6132	cmd.exe
4916	cmd.exe
5872	cmd.exe
4484	cmd.exe
3576	cmd.exe
1924	cmd.exe
4692	cmd.exe
4224	cmd.exe
3112	cmd.exe
4972	cmd.exe
5732	cmd.exe
3676	cmd.exe
2936	cmd.exe
4164	cmd.exe
5360	cmd.exe
6268	cmd.exe
1804	cmd.exe
3348	cmd.exe
1780	cmd.exe
4460	cmd.exe
4120	cmd.exe
6212	cmd.exe
5652	cmd.exe
4736	cmd.exe
4336	cmd.exe
4704	cmd.exe
2180	cmd.exe
6116	cmd.exe
5980	cmd.exe
4264	cmd.exe
2712	cmd.exe
4628	cmd.exe
6172	cmd.exe
6168	cmd.exe
6276	cmd.exe
764	cmd.exe
5756	cmd.exe
256	cmd.exe
3444	cmd.exe
5464	cmd.exe
4572	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 49 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5068	schtasks.exe
2536	schtasks.exe
5828	schtasks.exe
2852	schtasks.exe
5420	schtasks.exe
5464	schtasks.exe
4328	schtasks.exe
1276	schtasks.exe
5848	schtasks.exe
1268	schtasks.exe
3856	schtasks.exe
1200	schtasks.exe
4284	schtasks.exe
1264	schtasks.exe
3852	schtasks.exe
760	schtasks.exe
4548	schtasks.exe
2904	schtasks.exe
3372	schtasks.exe
3812	schtasks.exe
1328	schtasks.exe
6092	schtasks.exe
1496	schtasks.exe
6232	schtasks.exe
3660	schtasks.exe
4156	schtasks.exe
2740	schtasks.exe
5576	schtasks.exe
5872	schtasks.exe
4176	schtasks.exe
1660	schtasks.exe
3764	schtasks.exe
3472	schtasks.exe
6396	schtasks.exe
5196	schtasks.exe
3960	schtasks.exe
1484	schtasks.exe
1336	schtasks.exe
3416	schtasks.exe
5780	schtasks.exe
5796	schtasks.exe
2760	schtasks.exe
5788	schtasks.exe
5508	schtasks.exe
6016	schtasks.exe
2556	schtasks.exe
2076	schtasks.exe
4764	schtasks.exe
244	schtasks.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	TLaunche.exe
Token: SeDebugPrivilege	4832	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4832	MalwareDef.exe
Token: SeDebugPrivilege	4968	MalwareDef.exe
Token: SeDebugPrivilege	4772	MalwareDef.exe
Token: SeDebugPrivilege	2484	MalwareDef.exe
Token: SeDebugPrivilege	2832	MalwareDef.exe
Token: SeDebugPrivilege	52	MalwareDef.exe
Token: SeDebugPrivilege	4688	MalwareDef.exe
Token: SeDebugPrivilege	4892	MalwareDef.exe
Token: SeDebugPrivilege	2860	MalwareDef.exe
Token: SeDebugPrivilege	1504	MalwareDef.exe
Token: SeDebugPrivilege	5344	MalwareDef.exe
Token: SeDebugPrivilege	5096	MalwareDef.exe
Token: SeDebugPrivilege	1220	MalwareDef.exe
Token: SeDebugPrivilege	2644	MalwareDef.exe
Token: SeDebugPrivilege	1632	MalwareDef.exe
Token: SeDebugPrivilege	4136	MalwareDef.exe
Token: SeDebugPrivilege	3832	MalwareDef.exe
Token: SeDebugPrivilege	1968	MalwareDef.exe
Token: SeDebugPrivilege	2316	MalwareDef.exe
Token: SeDebugPrivilege	3960	MalwareDef.exe
Token: SeDebugPrivilege	3604	MalwareDef.exe
Token: SeDebugPrivilege	4232	MalwareDef.exe
Token: SeDebugPrivilege	3208	MalwareDef.exe
Token: SeDebugPrivilege	5808	MalwareDef.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 3264	4632	TLaunche.exe	90
PID 4632 wrote to memory of 2328	4632	TLaunche.exe	91
PID 2328 wrote to memory of 2852	2328	cmd.exe	94
PID 4632 wrote to memory of 4832	4632	TLaunche.exe	95
PID 4832 wrote to memory of 4736	4832	MalwareDef.exe	96
PID 4736 wrote to memory of 5796	4736	cmd.exe	98
PID 4832 wrote to memory of 5980	4832	MalwareDef.exe	101
PID 5980 wrote to memory of 4764	5980	cmd.exe	103
PID 4968 wrote to memory of 5048	4968	MalwareDef.exe	104
PID 5048 wrote to memory of 5420	5048	cmd.exe	106
PID 4772 wrote to memory of 4264	4772	MalwareDef.exe	107
PID 4264 wrote to memory of 1660	4264	cmd.exe	109
PID 4832 wrote to memory of 2612	4832	MalwareDef.exe	110
PID 2612 wrote to memory of 3660	2612	cmd.exe	112
PID 4832 wrote to memory of 1656	4832	MalwareDef.exe	113
PID 1656 wrote to memory of 5464	1656	cmd.exe	115
PID 4832 wrote to memory of 4484	4832	MalwareDef.exe	117
PID 4484 wrote to memory of 2760	4484	cmd.exe	119
PID 4832 wrote to memory of 1804	4832	MalwareDef.exe	120
PID 1804 wrote to memory of 3372	1804	cmd.exe	122
PID 4832 wrote to memory of 3348	4832	MalwareDef.exe	123
PID 3348 wrote to memory of 4328	3348	cmd.exe	125
PID 4832 wrote to memory of 764	4832	MalwareDef.exe	126
PID 764 wrote to memory of 2536	764	cmd.exe	128
PID 4832 wrote to memory of 2712	4832	MalwareDef.exe	129
PID 2712 wrote to memory of 5828	2712	cmd.exe	131
PID 4832 wrote to memory of 5736	4832	MalwareDef.exe	132
PID 5736 wrote to memory of 1268	5736	cmd.exe	134
PID 4832 wrote to memory of 4692	4832	MalwareDef.exe	135
PID 4692 wrote to memory of 2904	4692	cmd.exe	137
PID 4832 wrote to memory of 5756	4832	MalwareDef.exe	138
PID 5756 wrote to memory of 3812	5756	cmd.exe	140
PID 4832 wrote to memory of 3680	4832	MalwareDef.exe	141
PID 3680 wrote to memory of 5196	3680	cmd.exe	143
PID 4832 wrote to memory of 1932	4832	MalwareDef.exe	160
PID 1932 wrote to memory of 1328	1932	cmd.exe	162
PID 2832 wrote to memory of 2936	2832	MalwareDef.exe	163
PID 52 wrote to memory of 3704	52	MalwareDef.exe	165
PID 2484 wrote to memory of 1780	2484	MalwareDef.exe	164
PID 3704 wrote to memory of 3856	3704	cmd.exe	169
PID 1780 wrote to memory of 5788	1780	cmd.exe	170
PID 2936 wrote to memory of 4156	2936	cmd.exe	171
PID 5344 wrote to memory of 256	5344	MalwareDef.exe	172
PID 4688 wrote to memory of 5732	4688	MalwareDef.exe	173
PID 2860 wrote to memory of 3676	2860	MalwareDef.exe	176
PID 4892 wrote to memory of 3336	4892	MalwareDef.exe	177
PID 256 wrote to memory of 1200	256	cmd.exe	180
PID 5732 wrote to memory of 3764	5732	cmd.exe	181
PID 3336 wrote to memory of 3960	3336	cmd.exe	182
PID 3676 wrote to memory of 6092	3676	cmd.exe	183
PID 1504 wrote to memory of 3444	1504	MalwareDef.exe	184
PID 3444 wrote to memory of 5780	3444	cmd.exe	186
PID 5096 wrote to memory of 5652	5096	MalwareDef.exe	187
PID 1220 wrote to memory of 1848	1220	MalwareDef.exe	189
PID 5652 wrote to memory of 2740	5652	cmd.exe	191
PID 1848 wrote to memory of 4284	1848	cmd.exe	192
PID 3832 wrote to memory of 4460	3832	MalwareDef.exe	193
PID 4136 wrote to memory of 1096	4136	MalwareDef.exe	195
PID 1632 wrote to memory of 6132	1632	MalwareDef.exe	196
PID 2316 wrote to memory of 4628	2316	MalwareDef.exe	198
PID 2644 wrote to memory of 4336	2644	MalwareDef.exe	199
PID 4460 wrote to memory of 1264	4460	cmd.exe	204
PID 1968 wrote to memory of 4704	1968	MalwareDef.exe	202
PID 1096 wrote to memory of 5508	1096	cmd.exe	206

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TLaunche.exe
"C:\Users\Admin\AppData\Local\Temp\TLaunche.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="f{Nr5tn\5N,45m" dir=in action=allow program="C:\Users\Admin\Sub\MalwareDef.exe" enable=yes & exit
  2⤵
  PID:3264
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2852
- C:\Users\Admin\Sub\MalwareDef.exe
  "C:\Users\Admin\Sub\MalwareDef.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5464
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2760
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3372
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5828
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1268
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2904
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3812
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3812
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3852
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4224
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:760
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3800
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3472
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3424
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4176
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3112
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6016
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4164
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:244
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2180
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3416
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5844
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1276
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5360
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4548
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4916
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2556
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5464
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2076
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4972
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5068
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1332
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1924
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5848

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5420

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5788

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4156

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:52
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3856

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1200

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3960

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3764

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5780

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6132
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5872

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4284

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6092

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4704
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1336

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4336
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4628
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5576

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1264

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5508

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2740

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3960
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5064

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4232
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3576
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6232

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:1716

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5808
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6212

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3604
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6396

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:728

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:5884
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6276

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3208
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6116

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2028

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4508

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4328
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4572

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:3468

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2968

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2912
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6148

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6168

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2044

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2960

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2924
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6296

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4276

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:5968

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:1824

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:3516

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2764

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2572
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4316

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4468

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:3948
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4388

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:5928
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6240

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4132

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:6072
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5872

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4896

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6380

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4140

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:5828
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6268

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:1132

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:4928

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2272
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5228

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:832
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6172

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:5504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\Sub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4120

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:5408

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2904

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2356

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:2056

C:\Users\Admin\Sub\MalwareDef.exe
"C:\Users\Admin\Sub\MalwareDef.exe"
1⤵
- Executes dropped EXE
PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MalwareDef.exe

Path C:\Users\Admin\Sub\MalwareDef.exe
Size 221KB
SHA256 d9c9225729a1df9cba0ed9ad2a2028c836541ecb3668bc416d7767239c448743
MD5 d2225e059fce5f86f00b1923198ffadc
SHA1 87303a64cd5b123383bfd8949c4b9317a99e4ed1
SHA512 ed263d2076bc7d5be5056af86ecac9661e5377f18544644390dc4d73fb2ef2aa695938c48be3e0a452fdd85a36f02a8d6d80282a09c900f12614b067ed63eaa8
SSDEEP 1536:f5QdU6pya4+TeFiYtObodgXu5ibUivP1cIRlfPzVfNAR5bNOE2JDZ:fadXyUTeFhtObodS9hN2blE
TLSH
T17324E011AAFC3E63F81C1B3A6681434F27175B05C2AA7B582B4DB4B4219D9437F726BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4632-0-0x0000000000720000-0x000000000075E000-memory.dmp

Download

memory/4632-1-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp

Download

memory/4632-2-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4632-3-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4632-4-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4632-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4632-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4632-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4632-77-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads