3a6d63f80f77ecc69cb39395e9724e53ea5db1a20ab47dc501cd17f5d4712d6e

Analysis

user interaction
yes
max time kernel
137s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
BE VERY FUCKING CAREFUL ITS A DAMN VIRUS.bat
Size 360B
Sample260820-1c4vsayyft
SHA256 3a6d63f80f77ecc69cb39395e9724e53ea5db1a20ab47dc501cd17f5d4712d6e
MD5 a9f3d0062fa4dee1b151076108b2fd64
SHA1 06a0aa921065ec56d9dc51f14a45ae0d9ddda227
SHA512 f92cf1d586bd55b3a0565ed5549ec1c5e8553d7b779d2e684d08f44f81f5d8d15429d260c1a1a3db0fefbc4af7f865c6fb88b71b3476c92f4b10107da40fd187
TLSH
T164E0D845C4B11513E9B12E52031DAF1CEB0C948B70098A1334D810767E47FA9B2260C7
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BE VERY FUCKING CAREFUL ITS A DAMN VIRUS.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BE VERY FUCKING CAREFUL ITS A DAMN VIRUS.bat	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4204	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4300	shutdown.exe
Token: SeRemoteShutdownPrivilege	4300	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3108	PickerHost.exe
14512	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4300	4204	cmd.exe	91
PID 4204 wrote to memory of 4212	4204	cmd.exe	93
PID 4204 wrote to memory of 4996	4204	cmd.exe	94
PID 4204 wrote to memory of 4736	4204	cmd.exe	95
PID 4204 wrote to memory of 5832	4204	cmd.exe	96
PID 4204 wrote to memory of 2768	4204	cmd.exe	98
PID 4204 wrote to memory of 5796	4204	cmd.exe	99
PID 4204 wrote to memory of 2736	4204	cmd.exe	100
PID 4204 wrote to memory of 5044	4204	cmd.exe	101
PID 4204 wrote to memory of 4968	4204	cmd.exe	102
PID 4204 wrote to memory of 4444	4204	cmd.exe	103
PID 4204 wrote to memory of 2440	4204	cmd.exe	105
PID 4204 wrote to memory of 2988	4204	cmd.exe	107
PID 4204 wrote to memory of 720	4204	cmd.exe	108
PID 4204 wrote to memory of 3300	4204	cmd.exe	110
PID 4204 wrote to memory of 1508	4204	cmd.exe	111
PID 4204 wrote to memory of 1132	4204	cmd.exe	112
PID 4204 wrote to memory of 3424	4204	cmd.exe	113
PID 4204 wrote to memory of 4596	4204	cmd.exe	115
PID 4204 wrote to memory of 4656	4204	cmd.exe	116
PID 4204 wrote to memory of 2968	4204	cmd.exe	117
PID 4204 wrote to memory of 2568	4204	cmd.exe	119
PID 4204 wrote to memory of 884	4204	cmd.exe	120
PID 4204 wrote to memory of 2016	4204	cmd.exe	122
PID 4204 wrote to memory of 5048	4204	cmd.exe	124
PID 4204 wrote to memory of 6068	4204	cmd.exe	126
PID 4204 wrote to memory of 5992	4204	cmd.exe	127
PID 4204 wrote to memory of 4176	4204	cmd.exe	128
PID 4204 wrote to memory of 3152	4204	cmd.exe	129
PID 4204 wrote to memory of 1196	4204	cmd.exe	130
PID 4204 wrote to memory of 5328	4204	cmd.exe	131
PID 4204 wrote to memory of 5548	4204	cmd.exe	132
PID 4204 wrote to memory of 908	4204	cmd.exe	134
PID 4204 wrote to memory of 3392	4204	cmd.exe	135
PID 4204 wrote to memory of 3472	4204	cmd.exe	136
PID 4204 wrote to memory of 1888	4204	cmd.exe	137
PID 4204 wrote to memory of 1084	4204	cmd.exe	139
PID 4204 wrote to memory of 472	4204	cmd.exe	141
PID 4204 wrote to memory of 4304	4204	cmd.exe	142
PID 4204 wrote to memory of 2856	4204	cmd.exe	143
PID 4204 wrote to memory of 2612	4204	cmd.exe	146
PID 4204 wrote to memory of 4660	4204	cmd.exe	148
PID 4204 wrote to memory of 1592	4204	cmd.exe	149
PID 4204 wrote to memory of 1984	4204	cmd.exe	150
PID 4204 wrote to memory of 964	4204	cmd.exe	151
PID 4204 wrote to memory of 4376	4204	cmd.exe	152
PID 4204 wrote to memory of 636	4204	cmd.exe	155
PID 4204 wrote to memory of 1464	4204	cmd.exe	156
PID 4204 wrote to memory of 1312	4204	cmd.exe	158
PID 4204 wrote to memory of 1656	4204	cmd.exe	160
PID 4204 wrote to memory of 5032	4204	cmd.exe	161
PID 4204 wrote to memory of 2932	4204	cmd.exe	162
PID 4204 wrote to memory of 3856	4204	cmd.exe	165
PID 4204 wrote to memory of 2436	4204	cmd.exe	166
PID 4204 wrote to memory of 4488	4204	cmd.exe	167
PID 4204 wrote to memory of 944	4204	cmd.exe	168
PID 4204 wrote to memory of 2520	4204	cmd.exe	169
PID 4204 wrote to memory of 3000	4204	cmd.exe	170
PID 4204 wrote to memory of 1176	4204	cmd.exe	172
PID 4204 wrote to memory of 5620	4204	cmd.exe	173
PID 4204 wrote to memory of 708	4204	cmd.exe	174
PID 4204 wrote to memory of 4768	4204	cmd.exe	176
PID 4204 wrote to memory of 4208	4204	cmd.exe	177
PID 4204 wrote to memory of 3172	4204	cmd.exe	178

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BE VERY FUCKING CAREFUL ITS A DAMN VIRUS.bat"
1⤵
- Creates a file in the Startup directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\system32\shutdown.exe
  shutdown /s /t 10
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4212
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4996
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4736
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2768
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5796
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2736
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5044
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4968
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4444
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:720
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3300
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1508
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3424
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4596
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4656
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2968
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2568
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:884
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2016
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5048
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6068
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5992
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3152
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1196
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5548
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3392
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1888
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1084
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2612
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4660
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1592
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1984
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:964
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4376
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:636
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1464
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1656
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5032
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2932
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2436
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4488
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:944
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2520
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5620
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:708
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4768
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3172
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2124
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3796
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3604
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3136
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4572
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:864
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4232
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:704
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:764
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5076
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5780
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3528
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1900
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2688
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5536
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2544
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4284
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5828
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:924
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4620
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4952
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5752
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4704
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5408
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5084
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3376
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2904
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5504
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1512
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5820
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4104
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3688
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2144
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4164
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3448
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2408
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5352
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1884
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2140
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5228
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4688
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4680
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:200
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3104
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2632
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5172
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4308
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4652
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5316
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5496
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2236
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4740
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3676
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2272
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1416
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2056
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6164
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6188
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6200
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6216
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6224
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6236
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6248
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6684
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6716
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6740
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6748
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6756
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6764
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6772
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6780
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6788
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6796
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6804
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6812
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6820
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6828
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6836
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6844
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6864
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6880
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6896
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6944
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6968
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6984
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6996
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7004
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7012
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7020
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7032
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7040
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7056
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7072
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7080
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7104
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7128
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7140
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7164
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1044
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7348
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7356
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7364
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7372
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7388
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7396
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7404
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7412
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7420
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7428
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7436
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7444
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7452
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7468
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7476
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7484
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7512
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7544
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7568
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7580
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7596
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7604
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7636
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7660
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7688
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7716
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7724
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7732
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7740
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7748
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7756
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9404
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10296
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10420
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10628
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12004
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12356
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12444
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12468
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:13268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:14228

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3108

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa390a855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:14512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:16064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:16240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads