5f23d39421ae43ff4177b6beb46d74f92120cb3eac29babccd83235e4048c119

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

river.bat
Size

1KB
MD5

8001c60f0b7eb77d698fb2fd0d56c322
SHA1

abf52edb5f6e51ed060eb122093ddfb2ae29fc2a
SHA256

5f23d39421ae43ff4177b6beb46d74f92120cb3eac29babccd83235e4048c119
SHA512

a0d81b30691d7ec96b01749ac4677f2edfecc995c88056a65a6957bcfdca840f5b29c7269a0b7a3957a9147244a969422ec89f672e77b55a9f96b531ebe22f0e

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2688	timeout.exe
1608	timeout.exe
2920	timeout.exe
636	timeout.exe
828	timeout.exe
2524	timeout.exe
752	timeout.exe
2324	timeout.exe
876	timeout.exe
1112	timeout.exe
2128	timeout.exe
2292	timeout.exe
1716	timeout.exe
2972	timeout.exe
2496	timeout.exe
1756	timeout.exe
2560	timeout.exe
2092	timeout.exe
1992	timeout.exe
2632	timeout.exe
328	timeout.exe
1168	timeout.exe
2304	timeout.exe
2528	timeout.exe
1328	timeout.exe
440	timeout.exe
2204	timeout.exe
2232	timeout.exe
2488	timeout.exe
3056	timeout.exe
1928	timeout.exe
400	timeout.exe
928	timeout.exe
1648	timeout.exe
2408	timeout.exe
2284	timeout.exe
3016	timeout.exe
2124	timeout.exe
332	timeout.exe
688	timeout.exe
1952	timeout.exe
3064	timeout.exe
1556	timeout.exe
2812	timeout.exe
2336	timeout.exe
1360	timeout.exe
2672	timeout.exe
864	timeout.exe
2268	timeout.exe
2844	timeout.exe
2400	timeout.exe
548	timeout.exe
1976	timeout.exe
580	timeout.exe
792	timeout.exe
2772	timeout.exe
1644	timeout.exe
1820	timeout.exe
2236	timeout.exe
2980	timeout.exe
2468	timeout.exe
2828	timeout.exe
860	timeout.exe
1572	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2240	2180	cmd.exe	29
PID 2180 wrote to memory of 2240	2180	cmd.exe	29
PID 2180 wrote to memory of 2240	2180	cmd.exe	29
PID 2180 wrote to memory of 2584	2180	cmd.exe	30
PID 2180 wrote to memory of 2584	2180	cmd.exe	30
PID 2180 wrote to memory of 2584	2180	cmd.exe	30
PID 2180 wrote to memory of 2728	2180	cmd.exe	32
PID 2180 wrote to memory of 2728	2180	cmd.exe	32
PID 2180 wrote to memory of 2728	2180	cmd.exe	32
PID 2180 wrote to memory of 2812	2180	cmd.exe	33
PID 2180 wrote to memory of 2812	2180	cmd.exe	33
PID 2180 wrote to memory of 2812	2180	cmd.exe	33
PID 2180 wrote to memory of 2796	2180	cmd.exe	34
PID 2180 wrote to memory of 2796	2180	cmd.exe	34
PID 2180 wrote to memory of 2796	2180	cmd.exe	34
PID 2180 wrote to memory of 2732	2180	cmd.exe	35
PID 2180 wrote to memory of 2732	2180	cmd.exe	35
PID 2180 wrote to memory of 2732	2180	cmd.exe	35
PID 2180 wrote to memory of 2644	2180	cmd.exe	36
PID 2180 wrote to memory of 2644	2180	cmd.exe	36
PID 2180 wrote to memory of 2644	2180	cmd.exe	36
PID 2180 wrote to memory of 2604	2180	cmd.exe	37
PID 2180 wrote to memory of 2604	2180	cmd.exe	37
PID 2180 wrote to memory of 2604	2180	cmd.exe	37
PID 2180 wrote to memory of 2220	2180	cmd.exe	38
PID 2180 wrote to memory of 2220	2180	cmd.exe	38
PID 2180 wrote to memory of 2220	2180	cmd.exe	38
PID 2180 wrote to memory of 2828	2180	cmd.exe	39
PID 2180 wrote to memory of 2828	2180	cmd.exe	39
PID 2180 wrote to memory of 2828	2180	cmd.exe	39
PID 2180 wrote to memory of 2788	2180	cmd.exe	40
PID 2180 wrote to memory of 2788	2180	cmd.exe	40
PID 2180 wrote to memory of 2788	2180	cmd.exe	40
PID 2180 wrote to memory of 2632	2180	cmd.exe	41
PID 2180 wrote to memory of 2632	2180	cmd.exe	41
PID 2180 wrote to memory of 2632	2180	cmd.exe	41
PID 2180 wrote to memory of 2716	2180	cmd.exe	42
PID 2180 wrote to memory of 2716	2180	cmd.exe	42
PID 2180 wrote to memory of 2716	2180	cmd.exe	42
PID 2180 wrote to memory of 3056	2180	cmd.exe	43
PID 2180 wrote to memory of 3056	2180	cmd.exe	43
PID 2180 wrote to memory of 3056	2180	cmd.exe	43
PID 2180 wrote to memory of 2616	2180	cmd.exe	44
PID 2180 wrote to memory of 2616	2180	cmd.exe	44
PID 2180 wrote to memory of 2616	2180	cmd.exe	44
PID 2180 wrote to memory of 2756	2180	cmd.exe	45
PID 2180 wrote to memory of 2756	2180	cmd.exe	45
PID 2180 wrote to memory of 2756	2180	cmd.exe	45
PID 2180 wrote to memory of 2304	2180	cmd.exe	46
PID 2180 wrote to memory of 2304	2180	cmd.exe	46
PID 2180 wrote to memory of 2304	2180	cmd.exe	46
PID 2180 wrote to memory of 2528	2180	cmd.exe	47
PID 2180 wrote to memory of 2528	2180	cmd.exe	47
PID 2180 wrote to memory of 2528	2180	cmd.exe	47
PID 2180 wrote to memory of 2972	2180	cmd.exe	48
PID 2180 wrote to memory of 2972	2180	cmd.exe	48
PID 2180 wrote to memory of 2972	2180	cmd.exe	48
PID 2180 wrote to memory of 2524	2180	cmd.exe	49
PID 2180 wrote to memory of 2524	2180	cmd.exe	49
PID 2180 wrote to memory of 2524	2180	cmd.exe	49
PID 2180 wrote to memory of 2672	2180	cmd.exe	50
PID 2180 wrote to memory of 2672	2180	cmd.exe	50
PID 2180 wrote to memory of 2672	2180	cmd.exe	50
PID 2180 wrote to memory of 2052	2180	cmd.exe	51

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2584	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\river.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\mode.com
  mode con cols=800 lines=100
  2⤵
  PID:2240
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\river.bat
  2⤵
  - Views/modifies file attributes
  PID:2584
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2728
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2812
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2796
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2732
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2644
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2604
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2220
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2828
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2788
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2632
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2716
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3056
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2616
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2756
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2304
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2528
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2972
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2524
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2672
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2052
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2664
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2556
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2612
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2500
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2496
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2516
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1328
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2544
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2572
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2620
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2552
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2968
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2724
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:268
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:468
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2768
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2712
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2676
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2800
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:440
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1064
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:568
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:576
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1504
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:240
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1108
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2476
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2844
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1060
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1248
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1952
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1716
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1636
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2204
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2408
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2168
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2160
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2224
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2232
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2044
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:792
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1796
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:860
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2852
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1756
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2560
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2488
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:796
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2252
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2764
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2236
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2244
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:864
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2688
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1648
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1696
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1772
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2284
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1408
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3016
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2980
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2864
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1608
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1300
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1928
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2772
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1520
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1168
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2092
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2388
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3068
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3064
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2920
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2400
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2268
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:548
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2340
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1812
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2336
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:636
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:996
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1572
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1684
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1324
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2368
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2124
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2324
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:400
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:828
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2128
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2176
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1564
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:332
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1780
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1360
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1352
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1556
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1976
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:688
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1992
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1372
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1644
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:928
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:328
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2952
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1816
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3008
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1784
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1968
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1820
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:876
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:580
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2152
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2292
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:608
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2884
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2184
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2928
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2068
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2468
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2880
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...