5f23d39421ae43ff4177b6beb46d74f92120cb3eac29babccd83235e4048c119

Analysis

max time kernel
153s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

river.bat
Size

1KB
MD5

8001c60f0b7eb77d698fb2fd0d56c322
SHA1

abf52edb5f6e51ed060eb122093ddfb2ae29fc2a
SHA256

5f23d39421ae43ff4177b6beb46d74f92120cb3eac29babccd83235e4048c119
SHA512

a0d81b30691d7ec96b01749ac4677f2edfecc995c88056a65a6957bcfdca840f5b29c7269a0b7a3957a9147244a969422ec89f672e77b55a9f96b531ebe22f0e

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
4548	timeout.exe
2752	timeout.exe
428	timeout.exe
4540	timeout.exe
4708	timeout.exe
1020	timeout.exe
3956	timeout.exe
1980	timeout.exe
5096	timeout.exe
4504	timeout.exe
1468	timeout.exe
4308	timeout.exe
2748	timeout.exe
3712	timeout.exe
4492	timeout.exe
2116	timeout.exe
3844	timeout.exe
4116	timeout.exe
3096	timeout.exe
3052	timeout.exe
5024	timeout.exe
3396	timeout.exe
3796	timeout.exe
2856	timeout.exe
964	timeout.exe
1700	timeout.exe
3328	timeout.exe
1000	timeout.exe
2736	timeout.exe
3732	timeout.exe
4752	timeout.exe
4028	timeout.exe
964	timeout.exe
2436	timeout.exe
4516	timeout.exe
3604	timeout.exe
5004	timeout.exe
2028	timeout.exe
2296	timeout.exe
2980	timeout.exe
3060	timeout.exe
4552	timeout.exe
4436	timeout.exe
1288	timeout.exe
5068	timeout.exe
5100	timeout.exe
2884	timeout.exe
4400	timeout.exe
4120	timeout.exe
4456	timeout.exe
4196	timeout.exe
3700	timeout.exe
2760	timeout.exe
1460	timeout.exe
3088	timeout.exe
2412	timeout.exe
1056	timeout.exe
3348	timeout.exe
4288	timeout.exe
1160	timeout.exe
5056	timeout.exe
1208	timeout.exe
2576	timeout.exe
640	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4564	3416	cmd.exe	86
PID 3416 wrote to memory of 4564	3416	cmd.exe	86
PID 3416 wrote to memory of 2300	3416	cmd.exe	87
PID 3416 wrote to memory of 2300	3416	cmd.exe	87
PID 3416 wrote to memory of 1796	3416	cmd.exe	92
PID 3416 wrote to memory of 1796	3416	cmd.exe	92
PID 3416 wrote to memory of 5056	3416	cmd.exe	93
PID 3416 wrote to memory of 5056	3416	cmd.exe	93
PID 3416 wrote to memory of 1112	3416	cmd.exe	94
PID 3416 wrote to memory of 1112	3416	cmd.exe	94
PID 3416 wrote to memory of 428	3416	cmd.exe	97
PID 3416 wrote to memory of 428	3416	cmd.exe	97
PID 3416 wrote to memory of 2296	3416	cmd.exe	99
PID 3416 wrote to memory of 2296	3416	cmd.exe	99
PID 3416 wrote to memory of 2704	3416	cmd.exe	101
PID 3416 wrote to memory of 2704	3416	cmd.exe	101
PID 3416 wrote to memory of 1208	3416	cmd.exe	102
PID 3416 wrote to memory of 1208	3416	cmd.exe	102
PID 3416 wrote to memory of 2760	3416	cmd.exe	104
PID 3416 wrote to memory of 2760	3416	cmd.exe	104
PID 3416 wrote to memory of 2164	3416	cmd.exe	105
PID 3416 wrote to memory of 2164	3416	cmd.exe	105
PID 3416 wrote to memory of 2684	3416	cmd.exe	106
PID 3416 wrote to memory of 2684	3416	cmd.exe	106
PID 3416 wrote to memory of 3572	3416	cmd.exe	107
PID 3416 wrote to memory of 3572	3416	cmd.exe	107
PID 3416 wrote to memory of 3236	3416	cmd.exe	109
PID 3416 wrote to memory of 3236	3416	cmd.exe	109
PID 3416 wrote to memory of 5100	3416	cmd.exe	111
PID 3416 wrote to memory of 5100	3416	cmd.exe	111
PID 3416 wrote to memory of 2028	3416	cmd.exe	112
PID 3416 wrote to memory of 2028	3416	cmd.exe	112
PID 3416 wrote to memory of 5068	3416	cmd.exe	114
PID 3416 wrote to memory of 5068	3416	cmd.exe	114
PID 3416 wrote to memory of 1460	3416	cmd.exe	115
PID 3416 wrote to memory of 1460	3416	cmd.exe	115
PID 3416 wrote to memory of 1644	3416	cmd.exe	116
PID 3416 wrote to memory of 1644	3416	cmd.exe	116
PID 3416 wrote to memory of 1420	3416	cmd.exe	117
PID 3416 wrote to memory of 1420	3416	cmd.exe	117
PID 3416 wrote to memory of 4628	3416	cmd.exe	118
PID 3416 wrote to memory of 4628	3416	cmd.exe	118
PID 3416 wrote to memory of 1000	3416	cmd.exe	119
PID 3416 wrote to memory of 1000	3416	cmd.exe	119
PID 3416 wrote to memory of 3096	3416	cmd.exe	120
PID 3416 wrote to memory of 3096	3416	cmd.exe	120
PID 3416 wrote to memory of 3180	3416	cmd.exe	121
PID 3416 wrote to memory of 3180	3416	cmd.exe	121
PID 3416 wrote to memory of 1480	3416	cmd.exe	122
PID 3416 wrote to memory of 1480	3416	cmd.exe	122
PID 3416 wrote to memory of 3568	3416	cmd.exe	123
PID 3416 wrote to memory of 3568	3416	cmd.exe	123
PID 3416 wrote to memory of 4196	3416	cmd.exe	124
PID 3416 wrote to memory of 4196	3416	cmd.exe	124
PID 3416 wrote to memory of 1952	3416	cmd.exe	125
PID 3416 wrote to memory of 1952	3416	cmd.exe	125
PID 3416 wrote to memory of 4848	3416	cmd.exe	127
PID 3416 wrote to memory of 4848	3416	cmd.exe	127
PID 3416 wrote to memory of 2576	3416	cmd.exe	128
PID 3416 wrote to memory of 2576	3416	cmd.exe	128
PID 3416 wrote to memory of 2748	3416	cmd.exe	129
PID 3416 wrote to memory of 2748	3416	cmd.exe	129
PID 3416 wrote to memory of 5052	3416	cmd.exe	130
PID 3416 wrote to memory of 5052	3416	cmd.exe	130

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2300	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\river.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\system32\mode.com
  mode con cols=800 lines=100
  2⤵
  PID:4564
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\river.bat
  2⤵
  - Views/modifies file attributes
  PID:2300
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1796
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5056
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:428
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2296
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2704
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1208
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2760
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2164
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2684
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3572
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3236
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:5100
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2028
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5068
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1460
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1644
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1420
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4628
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1000
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3096
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3180
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1480
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3568
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4196
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1952
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4848
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2576
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2748
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:5052
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4884
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4708
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2856
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2732
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1796
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3724
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1436
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4984
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3160
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4028
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1980
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3052
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5096
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:5072
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2296
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:964
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2736
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4540
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2980
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2620
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5024
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2436
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3732
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:628
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3088
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3236
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5100
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4820
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1124
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2412
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2968
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4504
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2556
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1056
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4216
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4456
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2884
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2920
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3204
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3256
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3712
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2500
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4140
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4492
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4436
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1480
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3568
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4196
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3544
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4516
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3700
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4848
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3348
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3328
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3604
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3396
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4708
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2852
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:640
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3060
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2428
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:5060
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1020
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1288
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3772
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1868
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3796
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2064
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4288
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4028
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4552
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4924
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4892
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4092
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3016
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1608
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2116
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2868
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4312
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3956
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:964
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4548
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1208
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2980
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1700
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2620
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1160
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4400
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2684
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:368
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4120
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3088
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4116
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3236
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4912
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2944
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1632
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1468
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4428
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1060
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:944
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3700
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4848
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3348
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3328
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3844
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3396
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4708
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:5092
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:640
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...