71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a

Analysis

max time kernel
18s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe
Size 607KB
Sample261107-x8bbka1vbv
SHA256 71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a
MD5 5a0bb6e8abe7068646e62563f6d9f869
SHA1 cf4a3798e486f018e27ed703d178ba69d2ea5092
SHA512 f3c20ab4a1eca163ba4ab6c39d99b72319c0d2cb71fe85587aedb66cd3918fc1708119ae8dbcc6a8f2364fe6cfeaaedd60150e440596ffb0ec8a33a8d6f0ec69
SSDEEP 12288:M3KO1guEkfplV5uSJr4+94XP0LhrkOyu4283Z1reFSyrKSRf5n:MREkjrnCfIW28p5r+1B
TLSH
T1F9D423523D99B813D16C03BB78D5C12D43708E7AB299D20A77ED05CFABE8381278D59B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
224	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\ShutdownFX\\wallpaper.png"	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2064	cmd.exe
3412	cmd.exe
3396	cmd.exe
4756	cmd.exe
2044	cmd.exe
2872	cmd.exe
4480	cmd.exe
2000	cmd.exe
928	cmd.exe
2104	cmd.exe
3840	cmd.exe
2360	cmd.exe
944	cmd.exe
2788	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 25 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2872	cmd.exe
2000	cmd.exe
2064	cmd.exe
872	PING.EXE
4756	cmd.exe
1092	PING.EXE
4516	PING.EXE
1640	PING.EXE
4760	PING.EXE
1156	PING.EXE
4296	PING.EXE
620	PING.EXE
3192	PING.EXE
4476	PING.EXE
3412	cmd.exe
3396	cmd.exe
928	cmd.exe
2044	cmd.exe
2104	cmd.exe
3840	cmd.exe
2788	cmd.exe
4480	cmd.exe
876	PING.EXE
1980	PING.EXE
944	cmd.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2044	cmd.exe
3616	NETSTAT.EXE

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
624	ipconfig.exe
760	ipconfig.exe
3616	NETSTAT.EXE
4224	ipconfig.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\WallpaperStyle = "10"	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\TileWallpaper = "0"	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Runs net.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
4296	PING.EXE
4516	PING.EXE
4476	PING.EXE
1640	PING.EXE
4760	PING.EXE
872	PING.EXE
1156	PING.EXE
620	PING.EXE
3192	PING.EXE
876	PING.EXE
1980	PING.EXE
1092	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
224	tasklist.exe
224	tasklist.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe
Token: SeShutdownPrivilege	1268	shutdown.exe
Token: SeRemoteShutdownPrivilege	1268	shutdown.exe
Token: SeDebugPrivilege	224	tasklist.exe
Token: SeDebugPrivilege	3616	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4504	LogonUI.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 1268	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	85
PID 3720 wrote to memory of 944	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	87
PID 3720 wrote to memory of 2788	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	90
PID 944 wrote to memory of 4964	944	cmd.exe	91
PID 3720 wrote to memory of 2872	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	93
PID 944 wrote to memory of 3192	944	cmd.exe	95
PID 2788 wrote to memory of 624	2788	cmd.exe	96
PID 2872 wrote to memory of 2344	2872	cmd.exe	97
PID 2788 wrote to memory of 4516	2788	cmd.exe	98
PID 3720 wrote to memory of 2632	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	99
PID 2872 wrote to memory of 4476	2872	cmd.exe	101
PID 2632 wrote to memory of 2356	2632	cmd.exe	102
PID 2356 wrote to memory of 4588	2356	net.exe	103
PID 2632 wrote to memory of 1640	2632	cmd.exe	104
PID 3720 wrote to memory of 4480	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	105
PID 4480 wrote to memory of 1224	4480	cmd.exe	107
PID 3720 wrote to memory of 2000	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	108
PID 2000 wrote to memory of 224	2000	cmd.exe	111
PID 3720 wrote to memory of 2064	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	113
PID 2064 wrote to memory of 2964	2064	cmd.exe	115
PID 3720 wrote to memory of 3412	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	116
PID 3412 wrote to memory of 4752	3412	cmd.exe	118
PID 3720 wrote to memory of 1584	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	119
PID 1584 wrote to memory of 2020	1584	cmd.exe	121
PID 2020 wrote to memory of 4684	2020	net.exe	122
PID 3720 wrote to memory of 3396	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	123
PID 1584 wrote to memory of 876	1584	cmd.exe	125
PID 3396 wrote to memory of 760	3396	cmd.exe	126
PID 3396 wrote to memory of 4760	3396	cmd.exe	127
PID 3720 wrote to memory of 928	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	128
PID 2064 wrote to memory of 872	2064	cmd.exe	130
PID 928 wrote to memory of 4204	928	cmd.exe	131
PID 4204 wrote to memory of 4924	4204	net.exe	132
PID 3720 wrote to memory of 4756	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	133
PID 928 wrote to memory of 1980	928	cmd.exe	135
PID 3412 wrote to memory of 1092	3412	cmd.exe	136
PID 3720 wrote to memory of 2044	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	137
PID 4756 wrote to memory of 400	4756	cmd.exe	139
PID 3720 wrote to memory of 2104	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	140
PID 3720 wrote to memory of 3840	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	142
PID 2044 wrote to memory of 3616	2044	cmd.exe	144
PID 2104 wrote to memory of 3792	2104	cmd.exe	145
PID 3840 wrote to memory of 4224	3840	cmd.exe	146
PID 2104 wrote to memory of 1156	2104	cmd.exe	147
PID 3840 wrote to memory of 4296	3840	cmd.exe	148
PID 3720 wrote to memory of 2360	3720	71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe	151
PID 2044 wrote to memory of 620	2044	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe
"C:\Users\Admin\AppData\Local\Temp\71ae744fb3bf988ada9420e6b1b915004eae280235dbe472f5858a5efb562a1a.exe"
1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /s /t 15
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tree C:\Users /f > nul 2>&1 & echo Команда выполнена. & echo Команда выполнена. & echo Команда выполнена. & ping -n 1 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\system32\tree.com
    tree C:\Users /f
    3⤵
    PID:4964
- - C:\Windows\system32\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > nul 2>&1 & echo Команда выполнена. & echo Команда выполнена. & ping -n 2 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:624
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4516
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami /priv > nul 2>&1 & echo Команда выполнена. & ping -n 3 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\whoami.exe
    whoami /priv
    3⤵
    PID:2344
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4476
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net share & echo Команда выполнена. & ping -n 2 127.0.0.1 > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\system32\net.exe
    net share
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 share
      4⤵
      PID:4588
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1640
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tree "C:\Program Files" /f & echo Команда выполнена. & ping -n 1 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\system32\tree.com
    tree "C:\Program Files" /f
    3⤵
    PID:1224
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist /v & echo Команда выполнена. & echo Команда выполнена. & ping -n 1 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\tasklist.exe
    tasklist /v
    3⤵
    - Discovers running processes
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami /priv > nul 2>&1 & echo Команда выполнена. & echo Команда выполнена. & echo Команда выполнена. & echo Команда выполнена. & ping -n 1 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\whoami.exe
    whoami /priv
    3⤵
    PID:2964
- - C:\Windows\system32\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:872
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /query /fo list & echo Команда выполнена. & echo Команда выполнена. & echo Команда выполнена. & echo Команда выполнена. & ping -n 3 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\system32\schtasks.exe
    schtasks /query /fo list
    3⤵
    PID:4752
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1092
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net share & echo Команда выполнена. & ping -n 2 127.0.0.1 > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\net.exe
    net share
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 share
      4⤵
      PID:4684
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:876
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > nul 2>&1 & echo Команда выполнена. & echo Команда выполнена. & echo Команда выполнена. & ping -n 2 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:760
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4760
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user & echo Команда выполнена. & echo Команда выполнена. & echo Команда выполнена. & ping -n 1 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\system32\net.exe
    net user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:4924
- - C:\Windows\system32\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1980
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tree "C:\Program Files" /f & echo Команда выполнена. & echo Команда выполнена. & ping -n 2 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\tree.com
    tree "C:\Program Files" /f
    3⤵
    PID:400
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -ano & echo Команда выполнена. & echo Команда выполнена. & echo Команда выполнена. & ping -n 3 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:620
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami /priv & echo Команда выполнена. & echo Команда выполнена. & ping -n 1 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\whoami.exe
    whoami /priv
    3⤵
    PID:3792
- - C:\Windows\system32\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1156
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all & echo Команда выполнена. & ping -n 1 127.0.0.1 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4224
- - C:\Windows\system32\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4296
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /k echo.
  2⤵
  - Executes a command shell one-liner
  PID:2360

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4504