30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb

General

Target

30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
Sample

200108-d1xesb4fw2
SHA256

30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb

Score

8^/10

persistence evasion spreading

Malware Config

Signatures

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.execonhost.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 4816 wrote to memory of 4868	4816	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe	cmd.exe
PID 5096 wrote to memory of 4416	5096	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe	cmd.exe
PID 5096 wrote to memory of 4516	5096	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe	cmd.exe
PID 5096 wrote to memory of 1628	5096	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe	cmd.exe
PID 4628 wrote to memory of 4184	4628	conhost.exe	cmd.exe
PID 4184 wrote to memory of 4176	4184	cmd.exe	PING.EXE
PID 4184 wrote to memory of 4140	4184	cmd.exe	net.exe
PID 4140 wrote to memory of 4008	4140	net.exe	net1.exe
PID 4628 wrote to memory of 4020	4628	conhost.exe	cmd.exe
PID 4020 wrote to memory of 4104	4020	cmd.exe	PING.EXE
PID 4020 wrote to memory of 3972	4020	cmd.exe	net.exe
PID 3972 wrote to memory of 4108	3972	net.exe	net1.exe
PID 4628 wrote to memory of 3724	4628	conhost.exe	cmd.exe
PID 3724 wrote to memory of 3984	3724	cmd.exe	PING.EXE
PID 3724 wrote to memory of 4124	3724	cmd.exe	net.exe
PID 4124 wrote to memory of 4732	4124	net.exe	net1.exe
PID 4628 wrote to memory of 2408	4628	conhost.exe	cmd.exe
PID 2408 wrote to memory of 2372	2408	cmd.exe	PING.EXE
PID 2408 wrote to memory of 4736	2408	cmd.exe	net.exe
PID 4736 wrote to memory of 4776	4736	net.exe	net1.exe
PID 4628 wrote to memory of 4708	4628	conhost.exe	cmd.exe
PID 4708 wrote to memory of 4828	4708	cmd.exe	PING.EXE
PID 4708 wrote to memory of 4468	4708	cmd.exe	net.exe
PID 4468 wrote to memory of 4684	4468	net.exe	net1.exe
PID 4628 wrote to memory of 756	4628	conhost.exe	cmd.exe
PID 756 wrote to memory of 4856	756	cmd.exe	PING.EXE
PID 756 wrote to memory of 700	756	cmd.exe	net.exe
PID 700 wrote to memory of 4812	700	net.exe	net1.exe
PID 4628 wrote to memory of 4892	4628	conhost.exe	cmd.exe
PID 4892 wrote to memory of 4900	4892	cmd.exe	PING.EXE
PID 4892 wrote to memory of 4840	4892	cmd.exe	net.exe
PID 4840 wrote to memory of 4848	4840	net.exe	net1.exe
PID 4628 wrote to memory of 3332	4628	conhost.exe	cmd.exe
PID 3332 wrote to memory of 3528	3332	cmd.exe	PING.EXE
PID 3332 wrote to memory of 360	3332	cmd.exe	net.exe
PID 360 wrote to memory of 1988	360	net.exe	net1.exe
PID 4628 wrote to memory of 4980	4628	conhost.exe	cmd.exe
PID 4980 wrote to memory of 5020	4980	cmd.exe	PING.EXE
PID 4980 wrote to memory of 3596	4980	cmd.exe	net.exe
PID 3596 wrote to memory of 64	3596	net.exe	net1.exe
PID 4628 wrote to memory of 3292	4628	conhost.exe	cmd.exe
PID 3292 wrote to memory of 3464	3292	cmd.exe	PING.EXE
PID 3292 wrote to memory of 4520	3292	cmd.exe	net.exe
PID 4520 wrote to memory of 3668	4520	net.exe	net1.exe
PID 4628 wrote to memory of 3620	4628	conhost.exe	cmd.exe
PID 3620 wrote to memory of 4504	3620	cmd.exe	PING.EXE
PID 3620 wrote to memory of 4472	3620	cmd.exe	net.exe
PID 4472 wrote to memory of 4484	4472	net.exe	net1.exe
PID 4628 wrote to memory of 4508	4628	conhost.exe	cmd.exe
PID 4508 wrote to memory of 4044	4508	cmd.exe	PING.EXE
PID 4508 wrote to memory of 4380	4508	cmd.exe	net.exe
PID 4380 wrote to memory of 2076	4380	net.exe	net1.exe
PID 4628 wrote to memory of 4536	4628	conhost.exe	cmd.exe
PID 4536 wrote to memory of 4544	4536	cmd.exe	PING.EXE
PID 4536 wrote to memory of 4564	4536	cmd.exe	net.exe
PID 4564 wrote to memory of 3748	4564	net.exe	net1.exe
PID 4628 wrote to memory of 4228	4628	conhost.exe	cmd.exe
PID 4228 wrote to memory of 4172	4228	cmd.exe	PING.EXE
PID 4228 wrote to memory of 1712	4228	cmd.exe	net.exe
PID 1712 wrote to memory of 4132	1712	net.exe	net1.exe
PID 4628 wrote to memory of 3708	4628	conhost.exe	cmd.exe
PID 3708 wrote to memory of 4136	3708	cmd.exe	PING.EXE
PID 3708 wrote to memory of 1964	3708	cmd.exe	net.exe
PID 1964 wrote to memory of 4112	1964	net.exe	net1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.execonhost.exe

pid process

5096 30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
4628 conhost.exe

pid	process
5096	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
4628	conhost.exe

Drops file in Windows directory 8 IoCs

Processes:

cmd.exe30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.execmd.exe

description	ioc	process
File renamed	C:\Users\Admin\AppData\Local\Temp\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe => C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe	cmd.exe
File opened for modification	C:\Windows\InstallUtil.InstallLog	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
File opened for modification	C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.InstallLog	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
File created	C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.InstallState	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
File deleted	C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.InstallLog	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
File deleted	C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.InstallState	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
File deleted	C:\Windows\InstallUtil.InstallLog	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
File renamed	C:\Windows\Temp\tmpD30F.tmp => C:\Windows\conhost.exe	cmd.exe

Runs ping.exe 1 TTPs 59 IoCs

evasion spreading

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
4700	PING.EXE
3464	PING.EXE
4688	PING.EXE
3628	PING.EXE
4504	PING.EXE
2564	PING.EXE
4544	PING.EXE
4408	PING.EXE
3984	PING.EXE
504	PING.EXE
3120	PING.EXE
4544	PING.EXE
4176	PING.EXE
3416	PING.EXE
436	PING.EXE
1988	PING.EXE
2372	PING.EXE
444	PING.EXE
3400	PING.EXE
4988	PING.EXE
2224	PING.EXE
4980	PING.EXE
4900	PING.EXE
3528	PING.EXE
932	PING.EXE
2508	PING.EXE
4044	PING.EXE
1624	PING.EXE
2516	PING.EXE
784	PING.EXE
4540	PING.EXE
4172	PING.EXE
4172	PING.EXE
3684	PING.EXE
4992	PING.EXE
3436	PING.EXE
4812	PING.EXE
4472	PING.EXE
5020	PING.EXE
4948	PING.EXE
4136	PING.EXE
2112	PING.EXE
1620	PING.EXE
4704	PING.EXE
4444	PING.EXE
1264	PING.EXE
4708	PING.EXE
4880	PING.EXE
4828	PING.EXE
3464	PING.EXE
4836	PING.EXE
1448	PING.EXE
4104	PING.EXE
4856	PING.EXE
1620	PING.EXE
4892	PING.EXE
580	PING.EXE
4544	PING.EXE
2384	PING.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.execonhost.exe

description	pid	process
Token: SeDebugPrivilege	4816	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
Token: SeDebugPrivilege	4964	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
Token: SeDebugPrivilege	5096	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
Token: SeDebugPrivilege	4628	conhost.exe
Token: 33	4628	conhost.exe
Token: SeIncBasePriorityPrivilege	4628	conhost.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

cmd.exe

pid process

4868 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

conhost.exe

pid process

4628 conhost.exe

pid	process
4868	cmd.exe

pid	process
4628	conhost.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\AutoBackupLogFiles = "0"	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\csrss\EventMessageFile = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\EventLogMessages.dll"	30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe

Runs net.exe 110 IoCs

Processes:

net.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet1.exenet1.exenet1.exenet1.exenet1.exenet1.exenet1.exenet1.exenet1.exe

pid	process
4124	net.exe
4408	net.exe
2372	net.exe
4124	net.exe
3904	net.exe
4500	net.exe
3596	net.exe
1964	net.exe
1408	net.exe
4160	net.exe
4596	net.exe
4468	net.exe
4380	net.exe
4924	net.exe
4500	net.exe
4704	net.exe
3412	net.exe
4840	net.exe
4564	net.exe
300	net.exe
4816	net.exe
3800	net.exe
4140	net.exe
700	net.exe
3972	net.exe
432	net.exe
2184	net.exe
2428	net.exe
2404	net.exe
4472	net.exe
4820	net.exe
1988	net.exe
5000	net.exe
4520	net.exe
1712	net.exe
5016	net.exe
3208	net.exe
4796	net.exe
4412	net.exe
2228	net.exe
4580	net.exe
2592	net.exe
3444	net.exe
4468	net.exe
1984	net.exe
4020	net.exe
2392	net.exe
4428	net.exe
4824	net.exe
4756	net.exe
4736	net.exe
360	net.exe
1808	net.exe
3840	net.exe
5104	net.exe
688	net1.exe
3128	net1.exe
2684	net1.exe
4848	net1.exe
4112	net1.exe
4968	net1.exe
3748	net1.exe
1496	net1.exe
4264	net1.exe

C:\Users\Admin\AppData\Local\Temp\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
"C:\Users\Admin\AppData\Local\Temp\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c ping 127.0.0.1 -n 3 > nul && move "C:\Users\Admin\AppData\Local\Temp\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe" "C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe" && start "" C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe && exit
2⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
PID:4868

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 3
3⤵
- Runs ping.exe
PID:4880

C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
3⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:4964

C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe
"C:\Windows\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c ping 127.0.0.1 -n 1 > nul && del "C:\Windows\conhost".exe && exit
2⤵
PID:4416

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 1
3⤵
- Runs ping.exe
PID:3628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c ping 127.0.0.1 -n 1 > nul && cd C:\Windows\TEMP && move "tmpD30F.tmp" "C:\Windows\conhost.exe" && exit
2⤵
- Drops file in Windows directory
PID:4516

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 1
3⤵
- Runs ping.exe
PID:4472

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c ping 127.0.0.1 -n 2 > nul && start "" "C:\Windows\conhost.exe" nomLpvrwn+bYhunlL+B+QlB3CRqwJAl+ECjBTGCegLvDPermROFLZIyVEG890/b3LxqXVEMzIOWPbAtlo2HYdVQLotwEpEXuj+a0b7H6mIyWJavckjlozsFAZRq3Yfuv9bqgvwkeQs5dSmGCUIEtCGmINz/N1uPWvJOvzvojQOdeyKPgrfnNTpdoQ2enx/bNqweCryr2FN4uQNev8IXHWisdCME1z1/1OPBrmawROa2ervV+KmjerH3sMqYpVisLA0rAXUwQia3lZ1PD27QB9B/Bhw7QvuRvZH6OSRwnHcBGEqFisPuejgC7P3K5cAKGrx0udhzKFrHF/7SL/+iBfPxlmvmJuUlpe70oKVRglf4SuRIBu/QNgylyJJAvrlSOotFTivrTDVRdDF537Xyp+bPMUCzrxxL+QCTEf/0qvgAgXKe3U6ghSzId26SvHqlc8o6c9k8QYO7SyXQRPAVcPjYJ1DC4uTMpG6TtsCW/9JVZHQWWsV8Wp8H/6jy4ZvscncVAqZszmiHHOHsWlL8IOMzeMh3fSA9REEQ8W77WKcpp9lktjKCy2niPgdRY/Rkthzyj1EFBKs6/bwP+4LjwmYdGSCXvOBY1gp5tWmwlCEs= && exit
2⤵
PID:1628

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:4544

C:\Windows\conhost.exe
"C:\Windows\conhost.exe" nomLpvrwn+bYhunlL+B+QlB3CRqwJAl+ECjBTGCegLvDPermROFLZIyVEG890/b3LxqXVEMzIOWPbAtlo2HYdVQLotwEpEXuj+a0b7H6mIyWJavckjlozsFAZRq3Yfuv9bqgvwkeQs5dSmGCUIEtCGmINz/N1uPWvJOvzvojQOdeyKPgrfnNTpdoQ2enx/bNqweCryr2FN4uQNev8IXHWisdCME1z1/1OPBrmawROa2ervV+KmjerH3sMqYpVisLA0rAXUwQia3lZ1PD27QB9B/Bhw7QvuRvZH6OSRwnHcBGEqFisPuejgC7P3K5cAKGrx0udhzKFrHF/7SL/+iBfPxlmvmJuUlpe70oKVRglf4SuRIBu/QNgylyJJAvrlSOotFTivrTDVRdDF537Xyp+bPMUCzrxxL+QCTEf/0qvgAgXKe3U6ghSzId26SvHqlc8o6c9k8QYO7SyXQRPAVcPjYJ1DC4uTMpG6TtsCW/9JVZHQWWsV8Wp8H/6jy4ZvscncVAqZszmiHHOHsWlL8IOMzeMh3fSA9REEQ8W77WKcpp9lktjKCy2niPgdRY/Rkthzyj1EFBKs6/bwP+4LjwmYdGSCXvOBY1gp5tWmwlCEs=
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:4628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4176

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4104

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:3972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4108

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3984

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4732

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:2372

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4776

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4828

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4856

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4812

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4900

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:4848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3332

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3528

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:5020

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:3596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:64

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3464

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:3668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4504

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4484

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4044

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:2076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4536

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4544

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:4564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:3748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4172

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:1712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4136

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Suspicious use of WriteProcessMemory
- Runs net.exe
PID:1964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:4112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4108

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:444

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:824

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:932

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4148

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:984

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:2564

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:1092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:1172

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:1264

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:1408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:1496

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:1576

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:1624

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:1808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:1832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:1524

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:1620

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4736

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:2112

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:2392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:2500

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:2516

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:2548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4448

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3400

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:3128

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:3376

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3436

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:700

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4812

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:3904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4824

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4836

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:3412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4868

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:5000

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4988

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:1988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:4968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:5020

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3416

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:5016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:3404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4928

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4948

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:4264

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4552

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4544

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:3884

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4172

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:1984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:3700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:664

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:436

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:504

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:1544

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:1620

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:2372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:2400

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:2224

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:2392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
- Runs net.exe
PID:2684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:2548

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4704

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4692

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4444

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4856

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4708

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:3908

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:784

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4236

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:3556

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4892

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:1272

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4996

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:1988

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:5000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:3404

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4980

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4908

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4384

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4408

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:3800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:3748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:1728

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4540

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:3816

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4172

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3684

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:3840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:3884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:1964

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:580

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:2404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:3988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:300

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:504

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4120

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:1452

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:1448

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:5104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4780

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:2440

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4700

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:3772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:3052

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3464

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:2184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:528

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:2384

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:2592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:2112

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:2508

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:3208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4432

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:2548

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:3120

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:3444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:4468

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4688

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:2428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:4784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 1 > nul && net start csrss && exit
4⤵
PID:3368

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:4992

C:\Windows\SysWOW64\net.exe
net start csrss
5⤵
- Runs net.exe
PID:4500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start csrss
6⤵
PID:1824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\30cf8238f8cf6c84673248e969c727a6b6098050ff8962fb51af14612acc9beb.exe.log

Download Submit
C:\Windows\Temp\tmpD30F.tmp

Download Submit
C:\Windows\conhost.exe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads