Overview

overview

8

Static

static

5

juscned.exe

windows10-2004-x64

8

juscned.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    899s
  • max time network
    882s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 13:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    juscned.exe
  • Size 5.1MB
  • Sample260826-qrtm9azelb
  • SHA256 b73b6dc8a79e8931785c2ad0f344b2e620be57624bef4577c73c0d5b5f1f8b60
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes 1 TTPs 64 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\juscned.exe
    "C:\Users\Admin\AppData\Local\Temp\juscned.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq wireshark.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2956
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3436
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procmon.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4836
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procmon64.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1476
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procexp.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procexp64.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq processhacker.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5992
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:6076
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:980
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4968
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ida.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ida64.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1036
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq idag.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4556
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq idag64.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2580
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq idaw.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2228
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq idaw64.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:6004
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq fiddler.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3400
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2292
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2356
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq dnspy.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:5252
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq pestudio.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:2980
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:796
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq hxd.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1480
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq devenv.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5784
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq windbg.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2016
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1396
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5936
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq autoruns.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4940
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4500
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq filemon.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5916
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq regmon.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:6000
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2576
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:6132
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4604
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3036
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3488
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4700
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq xenservice.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5996
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4828
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1512
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:3484
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4072
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4108
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5920
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4360
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1932
    • C:\Windows\system32\schtasks.exe
      schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\juscned_task.xml /TN juscned /F
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3136
    • C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
      "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" --installed
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4856
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq wireshark.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4484
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1120
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq procmon.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5784
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq procmon64.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq procexp.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq procexp64.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5936
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq processhacker.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5376
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2416
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5608
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2484
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ida.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1068
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ida64.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4712
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq idag.exe" /NH
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:300
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq idag64.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4544
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq idaw.exe" /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1380
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq idaw64.exe" /NH
        3⤵
        • Discovers running processes
        PID:1192
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq fiddler.exe" /NH
        3⤵
          PID:1488
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
          3⤵
            PID:2036
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
            3⤵
            • Discovers running processes
            PID:5996
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq dnspy.exe" /NH
            3⤵
            • Discovers running processes
            PID:4412
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              4⤵
                PID:4828
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq pestudio.exe" /NH
              3⤵
                PID:3448
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
                3⤵
                • Discovers running processes
                PID:200
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq hxd.exe" /NH
                3⤵
                • Discovers running processes
                PID:4072
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq devenv.exe" /NH
                3⤵
                  PID:2004
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq windbg.exe" /NH
                  3⤵
                  • Discovers running processes
                  PID:3964
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    4⤵
                      PID:4108
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
                    3⤵
                    • Discovers running processes
                    PID:4492
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
                    3⤵
                    • Discovers running processes
                    PID:2156
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq autoruns.exe" /NH
                    3⤵
                      PID:4808
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
                      3⤵
                        PID:3180
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FI "IMAGENAME eq filemon.exe" /NH
                        3⤵
                          PID:1188
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq regmon.exe" /NH
                          3⤵
                          • Discovers running processes
                          PID:996
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
                          3⤵
                            PID:1812
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
                            3⤵
                            • Discovers running processes
                            PID:4868
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
                            3⤵
                            • Discovers running processes
                            PID:3628
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
                            3⤵
                              PID:5268
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
                              3⤵
                                PID:480
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  4⤵
                                    PID:5936
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
                                  3⤵
                                    PID:3508
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
                                    3⤵
                                      PID:5328
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
                                      3⤵
                                      • Discovers running processes
                                      PID:5200
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq xenservice.exe" /NH
                                      3⤵
                                      • Discovers running processes
                                      PID:5476
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
                                      3⤵
                                        PID:5212
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
                                        3⤵
                                          PID:5280
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
                                          3⤵
                                            PID:2000
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
                                            3⤵
                                            • Discovers running processes
                                            PID:5384
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              4⤵
                                                PID:1380
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
                                              3⤵
                                                PID:3068
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
                                                3⤵
                                                  PID:5284
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
                                                  3⤵
                                                  • Discovers running processes
                                                  PID:1124
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
                                                  3⤵
                                                    PID:1964
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      4⤵
                                                        PID:3448
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
                                                      3⤵
                                                        PID:3324
                                                        • C:\Windows\System32\Conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          4⤵
                                                            PID:200
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\juscned_task.xml /TN juscned /F
                                                          3⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2428
                                                        • C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
                                                          "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" --watchdog 4856 --wd-target "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:5112
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
                                                          3⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4436
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            4⤵
                                                              PID:3964
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4768
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4972
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
                                                            3⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5752
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              4⤵
                                                                PID:1068
                                                        • C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
                                                          "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          PID:5540
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /FI "IMAGENAME eq wireshark.exe" /NH
                                                            2⤵
                                                            • Discovers running processes
                                                            PID:4872
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
                                                            2⤵
                                                            • Discovers running processes
                                                            PID:4212
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /FI "IMAGENAME eq procmon.exe" /NH
                                                            2⤵
                                                            • Discovers running processes
                                                            PID:3484
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /FI "IMAGENAME eq procmon64.exe" /NH
                                                            2⤵
                                                            • Discovers running processes
                                                            PID:1288
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /FI "IMAGENAME eq procexp.exe" /NH
                                                            2⤵
                                                              PID:812
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist /FI "IMAGENAME eq procexp64.exe" /NH
                                                              2⤵
                                                              • Discovers running processes
                                                              PID:4812
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist /FI "IMAGENAME eq processhacker.exe" /NH
                                                              2⤵
                                                                PID:1696
                                                              • C:\Windows\system32\tasklist.exe
                                                                tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
                                                                2⤵
                                                                • Discovers running processes
                                                                PID:2384
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  3⤵
                                                                    PID:1812
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
                                                                  2⤵
                                                                    PID:2460
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
                                                                    2⤵
                                                                      PID:908
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      tasklist /FI "IMAGENAME eq ida.exe" /NH
                                                                      2⤵
                                                                      • Discovers running processes
                                                                      PID:2856
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      tasklist /FI "IMAGENAME eq ida64.exe" /NH
                                                                      2⤵
                                                                        PID:3340
                                                                      • C:\Windows\system32\tasklist.exe
                                                                        tasklist /FI "IMAGENAME eq idag.exe" /NH
                                                                        2⤵
                                                                          PID:5384
                                                                        • C:\Windows\system32\tasklist.exe
                                                                          tasklist /FI "IMAGENAME eq idag64.exe" /NH
                                                                          2⤵
                                                                          • Discovers running processes
                                                                          PID:3048
                                                                        • C:\Windows\system32\tasklist.exe
                                                                          tasklist /FI "IMAGENAME eq idaw.exe" /NH
                                                                          2⤵
                                                                            PID:5116
                                                                          • C:\Windows\system32\tasklist.exe
                                                                            tasklist /FI "IMAGENAME eq idaw64.exe" /NH
                                                                            2⤵
                                                                              PID:2816
                                                                              • C:\Windows\System32\Conhost.exe
                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                3⤵
                                                                                  PID:4872
                                                                              • C:\Windows\system32\tasklist.exe
                                                                                tasklist /FI "IMAGENAME eq fiddler.exe" /NH
                                                                                2⤵
                                                                                  PID:1888
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
                                                                                  2⤵
                                                                                    PID:2184
                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
                                                                                    2⤵
                                                                                    • Discovers running processes
                                                                                    PID:1908
                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                    tasklist /FI "IMAGENAME eq dnspy.exe" /NH
                                                                                    2⤵
                                                                                    • Discovers running processes
                                                                                    PID:2580
                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
                                                                                    2⤵
                                                                                    • Discovers running processes
                                                                                    PID:2368
                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                    tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
                                                                                    2⤵
                                                                                      PID:5076
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        3⤵
                                                                                          PID:4072
                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                        tasklist /FI "IMAGENAME eq hxd.exe" /NH
                                                                                        2⤵
                                                                                        • Discovers running processes
                                                                                        PID:1932
                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                        tasklist /FI "IMAGENAME eq devenv.exe" /NH
                                                                                        2⤵
                                                                                          PID:3136
                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                          tasklist /FI "IMAGENAME eq windbg.exe" /NH
                                                                                          2⤵
                                                                                            PID:5960
                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                            tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
                                                                                            2⤵
                                                                                            • Discovers running processes
                                                                                            PID:4424
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              3⤵
                                                                                                PID:4492
                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                              tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
                                                                                              2⤵
                                                                                                PID:4112
                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq autoruns.exe" /NH
                                                                                                2⤵
                                                                                                  PID:4944
                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
                                                                                                  2⤵
                                                                                                  • Discovers running processes
                                                                                                  PID:5184
                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                  tasklist /FI "IMAGENAME eq filemon.exe" /NH
                                                                                                  2⤵
                                                                                                    PID:2612
                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                    tasklist /FI "IMAGENAME eq regmon.exe" /NH
                                                                                                    2⤵
                                                                                                    • Discovers running processes
                                                                                                    PID:2480
                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                    tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
                                                                                                    2⤵
                                                                                                      PID:4908
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        3⤵
                                                                                                          PID:3628
                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                        tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
                                                                                                        2⤵
                                                                                                          PID:2504
                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                          tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
                                                                                                          2⤵
                                                                                                            PID:3788
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              3⤵
                                                                                                                PID:2416
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
                                                                                                              2⤵
                                                                                                                PID:5080
                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
                                                                                                                2⤵
                                                                                                                  PID:3508
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
                                                                                                                  2⤵
                                                                                                                  • Discovers running processes
                                                                                                                  PID:4956
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
                                                                                                                  2⤵
                                                                                                                    PID:5280
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
                                                                                                                    2⤵
                                                                                                                    • Discovers running processes
                                                                                                                    PID:4920
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      3⤵
                                                                                                                        PID:3340
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /FI "IMAGENAME eq xenservice.exe" /NH
                                                                                                                      2⤵
                                                                                                                      • Discovers running processes
                                                                                                                      PID:2668
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
                                                                                                                      2⤵
                                                                                                                        PID:2908
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          3⤵
                                                                                                                            PID:3048
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
                                                                                                                          2⤵
                                                                                                                          • Discovers running processes
                                                                                                                          PID:1488
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
                                                                                                                          2⤵
                                                                                                                            PID:1236
                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                            tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
                                                                                                                            2⤵
                                                                                                                              PID:2812
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
                                                                                                                              2⤵
                                                                                                                                PID:2540
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  3⤵
                                                                                                                                    PID:2184
                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
                                                                                                                                  2⤵
                                                                                                                                  • Discovers running processes
                                                                                                                                  PID:1332
                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
                                                                                                                                  2⤵
                                                                                                                                    PID:3504
                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      3⤵
                                                                                                                                        PID:2580
                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                      tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
                                                                                                                                      2⤵
                                                                                                                                      • Discovers running processes
                                                                                                                                      PID:832
                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                      tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
                                                                                                                                      2⤵
                                                                                                                                        PID:1948
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                      1⤵
                                                                                                                                        PID:2736
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:908
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                          1⤵
                                                                                                                                            PID:4996
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                              PID:2372
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                              1⤵
                                                                                                                                                PID:2008
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                1⤵
                                                                                                                                                  PID:1952
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2372
                                                                                                                                                  • C:\Windows\system32\sihost.exe
                                                                                                                                                    sihost.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                    PID:4656
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                      2⤵
                                                                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:2688
                                                                                                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:4436
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:5924
                                                                                                                                                  • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                    \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3532

                                                                                                                                                    Network

                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                          Reconnaissance

                                                                                                                                                          Resource Development

                                                                                                                                                          Initial Access

                                                                                                                                                          Execution

                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                          1
                                                                                                                                                          T1059

                                                                                                                                                          PowerShell

                                                                                                                                                          1
                                                                                                                                                          T1059.001

                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                          1
                                                                                                                                                          T1053

                                                                                                                                                          Scheduled Task

                                                                                                                                                          1
                                                                                                                                                          T1053.005

                                                                                                                                                          Persistence

                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                          1
                                                                                                                                                          T1547

                                                                                                                                                          Active Setup

                                                                                                                                                          1
                                                                                                                                                          T1547.014

                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                          1
                                                                                                                                                          T1053

                                                                                                                                                          Scheduled Task

                                                                                                                                                          1
                                                                                                                                                          T1053.005

                                                                                                                                                          Privilege Escalation

                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                          1
                                                                                                                                                          T1547

                                                                                                                                                          Active Setup

                                                                                                                                                          1
                                                                                                                                                          T1547.014

                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                          1
                                                                                                                                                          T1053

                                                                                                                                                          Scheduled Task

                                                                                                                                                          1
                                                                                                                                                          T1053.005

                                                                                                                                                          Defense Evasion

                                                                                                                                                          Modify Registry

                                                                                                                                                          2
                                                                                                                                                          T1112

                                                                                                                                                          Credential Access

                                                                                                                                                          Credentials from Password Stores

                                                                                                                                                          1
                                                                                                                                                          T1555

                                                                                                                                                          Credentials from Web Browsers

                                                                                                                                                          1
                                                                                                                                                          T1555.003

                                                                                                                                                          Unsecured Credentials

                                                                                                                                                          6
                                                                                                                                                          T1552

                                                                                                                                                          Credentials In Files

                                                                                                                                                          5
                                                                                                                                                          T1552.001

                                                                                                                                                          Credentials in Registry

                                                                                                                                                          1
                                                                                                                                                          T1552.002

                                                                                                                                                          Discovery

                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                          2
                                                                                                                                                          T1120

                                                                                                                                                          Process Discovery

                                                                                                                                                          1
                                                                                                                                                          T1057

                                                                                                                                                          Query Registry

                                                                                                                                                          3
                                                                                                                                                          T1012

                                                                                                                                                          System Information Discovery

                                                                                                                                                          3
                                                                                                                                                          T1082

                                                                                                                                                          Lateral Movement

                                                                                                                                                          Collection

                                                                                                                                                          Data from Local System

                                                                                                                                                          5
                                                                                                                                                          T1005

                                                                                                                                                          Email Collection

                                                                                                                                                          1
                                                                                                                                                          T1114

                                                                                                                                                          Command and Control

                                                                                                                                                          Exfiltration

                                                                                                                                                          Impact

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          juscned.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
                                                                                                                                                          • Size 5.1MB
                                                                                                                                                          • SHA256 b73b6dc8a79e8931785c2ad0f344b2e620be57624bef4577c73c0d5b5f1f8b60
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          Login Data.tmp_wr
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp_wr
                                                                                                                                                          • Size 40KB
                                                                                                                                                          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          Cookies.tmp_wr
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.tmp_wr
                                                                                                                                                          • Size 20KB
                                                                                                                                                          • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          Web Data.tmp_wr
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.tmp_wr
                                                                                                                                                          • Size 138KB
                                                                                                                                                          • SHA256 f02d21bc04af97d86c8d1d3849061cb55a03473099b5580aa72b237a245049f3
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          Cookies.tmp_wr
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies.tmp_wr
                                                                                                                                                          • Size 24KB
                                                                                                                                                          • SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          Web Data.tmp_wr
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.tmp_wr
                                                                                                                                                          • Size 256KB
                                                                                                                                                          • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          • Size 1KB
                                                                                                                                                          • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          • Size 1KB
                                                                                                                                                          • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                          • Size 591B
                                                                                                                                                          • SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                          • Size 599B
                                                                                                                                                          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          __PSScriptPolicyTest_wxpljzqd.jg5.ps1
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wxpljzqd.jg5.ps1
                                                                                                                                                          • Size 60B
                                                                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          juscned_task.xml
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\juscned_task.xml
                                                                                                                                                          • Size 1KB
                                                                                                                                                          • SHA256 f400ac3c7ef2b410a693a9d6ef28877a42376de678c57907a97782b60d0ce695
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          wruntime.log
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
                                                                                                                                                          • Size 978B
                                                                                                                                                          • SHA256 26638a5840641aa6d2ee735a7d8acb6cb92cc3e33374290292bc1901f73c28d9
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          wruntime.log
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
                                                                                                                                                          • Size 1KB
                                                                                                                                                          • SHA256 45bb26c86a386b53b96aa4a09df367a93d5d9405057dc1231dd0221c7e3aed95
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          wruntime.log
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
                                                                                                                                                          • Size 2KB
                                                                                                                                                          • SHA256 68d2d361119956d07ae66ddaa4c1626caa0eade525765e6fa3de7b19e98d009d
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          memory/4372-0-0x0000000000D50000-0x0000000001B50000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4372-8-0x0000000000D50000-0x0000000001B50000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4372-9-0x0000000000D50000-0x0000000001B50000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4436-21-0x00000260BE670000-0x00000260BE692000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-119-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-107-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-10-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-39-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-37-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-78-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-137-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-135-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-133-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-82-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-131-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-85-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-129-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-87-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-127-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-89-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-125-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-91-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-123-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-93-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-121-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-95-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-117-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-97-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-115-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-99-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-113-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-101-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-111-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-103-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-109-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-105-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-106-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-92-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-108-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-104-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-110-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-102-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-112-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-100-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-114-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-98-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-116-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-96-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-118-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-17-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-120-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-94-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-122-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-41-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-124-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-90-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-126-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-88-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-128-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-86-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-130-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-84-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-132-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-138-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-134-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-80-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5112-136-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5540-79-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5540-81-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5540-12-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5540-38-0x0000000000C10000-0x0000000001A10000-memory.dmp
                                                                                                                                                          Download