4aa36a904fd0e7f2b447ea91ea122615b1363d1acf4b639a7e6232cf599aacda

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_×.bat
Size

2KB
MD5

4ab6a093ac6f62d696e996aa030d9e5e
SHA1

22736b9a4ea87bd46e6656c5aa5d4f7bb8f805c8
SHA256

4aa36a904fd0e7f2b447ea91ea122615b1363d1acf4b639a7e6232cf599aacda
SHA512

f16c6a13756d20ac799052bf66f4a1d87f213877c85304580f472c6d1d5779a8eda596d159c5e58835e59f5df85b33ba05ca38b569bd5f0d48d5cfef4da28d57

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Screenshot_20230925_164623_Gallery.jpg"	reg.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
4796	timeout.exe
4488	timeout.exe
2012	timeout.exe
4320	timeout.exe
880	timeout.exe
1108	timeout.exe
2812	timeout.exe
4880	timeout.exe
4824	timeout.exe
4020	timeout.exe
548	timeout.exe
4416	timeout.exe
3880	timeout.exe
4732	timeout.exe
3328	timeout.exe
2540	timeout.exe
2448	timeout.exe
3788	timeout.exe
2040	timeout.exe
2332	timeout.exe
4128	timeout.exe
4324	timeout.exe
4812	timeout.exe
4344	timeout.exe
3572	timeout.exe
1740	timeout.exe
4000	timeout.exe
3876	timeout.exe
4220	timeout.exe
2004	timeout.exe
3704	timeout.exe
4016	timeout.exe
3860	timeout.exe
3868	timeout.exe
1776	timeout.exe
1920	timeout.exe
1508	timeout.exe
1348	timeout.exe
2092	timeout.exe
452	timeout.exe
4120	timeout.exe
4548	timeout.exe
4184	timeout.exe
4984	timeout.exe
4584	timeout.exe
4504	timeout.exe
4836	timeout.exe
1248	timeout.exe
2932	timeout.exe
1568	timeout.exe
1208	timeout.exe
2120	timeout.exe
3372	timeout.exe
1348	timeout.exe
1112	timeout.exe
620	timeout.exe
412	timeout.exe
2288	timeout.exe
4168	timeout.exe
1380	timeout.exe
5100	timeout.exe
3640	timeout.exe
404	timeout.exe
3104	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3916	2168	cmd.exe	84
PID 2168 wrote to memory of 3916	2168	cmd.exe	84
PID 2168 wrote to memory of 1776	2168	cmd.exe	85
PID 2168 wrote to memory of 1776	2168	cmd.exe	85
PID 2168 wrote to memory of 880	2168	cmd.exe	86
PID 2168 wrote to memory of 880	2168	cmd.exe	86
PID 2168 wrote to memory of 816	2168	cmd.exe	87
PID 2168 wrote to memory of 816	2168	cmd.exe	87
PID 2168 wrote to memory of 1556	2168	cmd.exe	88
PID 2168 wrote to memory of 1556	2168	cmd.exe	88
PID 2168 wrote to memory of 3112	2168	cmd.exe	89
PID 2168 wrote to memory of 3112	2168	cmd.exe	89
PID 2168 wrote to memory of 2004	2168	cmd.exe	90
PID 2168 wrote to memory of 2004	2168	cmd.exe	90
PID 2168 wrote to memory of 4020	2168	cmd.exe	92
PID 2168 wrote to memory of 4020	2168	cmd.exe	92
PID 2168 wrote to memory of 3908	2168	cmd.exe	93
PID 2168 wrote to memory of 3908	2168	cmd.exe	93
PID 2168 wrote to memory of 2120	2168	cmd.exe	96
PID 2168 wrote to memory of 2120	2168	cmd.exe	96
PID 2168 wrote to memory of 1920	2168	cmd.exe	99
PID 2168 wrote to memory of 1920	2168	cmd.exe	99
PID 2168 wrote to memory of 4428	2168	cmd.exe	101
PID 2168 wrote to memory of 4428	2168	cmd.exe	101
PID 2168 wrote to memory of 1536	2168	cmd.exe	102
PID 2168 wrote to memory of 1536	2168	cmd.exe	102
PID 2168 wrote to memory of 404	2168	cmd.exe	104
PID 2168 wrote to memory of 404	2168	cmd.exe	104
PID 2168 wrote to memory of 4524	2168	cmd.exe	105
PID 2168 wrote to memory of 4524	2168	cmd.exe	105
PID 2168 wrote to memory of 2812	2168	cmd.exe	106
PID 2168 wrote to memory of 2812	2168	cmd.exe	106
PID 2168 wrote to memory of 1564	2168	cmd.exe	108
PID 2168 wrote to memory of 1564	2168	cmd.exe	108
PID 2168 wrote to memory of 2932	2168	cmd.exe	110
PID 2168 wrote to memory of 2932	2168	cmd.exe	110
PID 2168 wrote to memory of 4908	2168	cmd.exe	111
PID 2168 wrote to memory of 4908	2168	cmd.exe	111
PID 2168 wrote to memory of 4732	2168	cmd.exe	112
PID 2168 wrote to memory of 4732	2168	cmd.exe	112
PID 2168 wrote to memory of 4584	2168	cmd.exe	113
PID 2168 wrote to memory of 4584	2168	cmd.exe	113
PID 2168 wrote to memory of 3372	2168	cmd.exe	114
PID 2168 wrote to memory of 3372	2168	cmd.exe	114
PID 2168 wrote to memory of 4652	2168	cmd.exe	115
PID 2168 wrote to memory of 4652	2168	cmd.exe	115
PID 2168 wrote to memory of 2576	2168	cmd.exe	116
PID 2168 wrote to memory of 2576	2168	cmd.exe	116
PID 2168 wrote to memory of 3104	2168	cmd.exe	117
PID 2168 wrote to memory of 3104	2168	cmd.exe	117
PID 2168 wrote to memory of 2872	2168	cmd.exe	118
PID 2168 wrote to memory of 2872	2168	cmd.exe	118
PID 2168 wrote to memory of 1212	2168	cmd.exe	119
PID 2168 wrote to memory of 1212	2168	cmd.exe	119
PID 2168 wrote to memory of 2144	2168	cmd.exe	120
PID 2168 wrote to memory of 2144	2168	cmd.exe	120
PID 2168 wrote to memory of 4880	2168	cmd.exe	121
PID 2168 wrote to memory of 4880	2168	cmd.exe	121
PID 2168 wrote to memory of 5100	2168	cmd.exe	122
PID 2168 wrote to memory of 5100	2168	cmd.exe	122
PID 2168 wrote to memory of 3704	2168	cmd.exe	124
PID 2168 wrote to memory of 3704	2168	cmd.exe	124
PID 2168 wrote to memory of 3720	2168	cmd.exe	125
PID 2168 wrote to memory of 3720	2168	cmd.exe	125

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1556	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_×.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\curl.exe
  curl -o Screenshot_20230925_164623_Gallery.jpg https://cdn.discordapp.com/attachments/1145446819875266601/1155983688413216838/Screenshot_20230925_164623_Gallery.jpg
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\Screenshot_20230925_164623_Gallery.jpg /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:1776
- C:\Windows\system32\rundll32.exe
  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
  2⤵
  PID:880
- C:\Windows\system32\mode.com
  mode con cols= 800 lines= 100
  2⤵
  PID:816
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\_×.bat
  2⤵
  - Views/modifies file attributes
  PID:1556
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4020
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2120
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1920
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4428
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1536
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:404
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4524
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2812
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1564
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2932
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4732
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4584
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3372
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4652
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2576
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3104
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2872
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1212
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2144
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4880
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5100
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3704
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3720
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4168
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3300
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2152
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4164
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2952
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2448
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1612
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:416
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2132
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3828
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1208
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3788
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4824
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1040
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3200
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4128
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1348
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4812
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3460
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4148
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2148
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3860
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4876
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2180
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4016
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1508
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4344
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1848
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:620
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1420
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3660
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2012
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2136
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1780
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:412
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4548
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:5032
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2880
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4336
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1284
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3572
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4020
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3016
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:528
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1776
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2040
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3876
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4784
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2332
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3276
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2968
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3640
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:548
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1740
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3736
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4236
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4184
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4984
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:216
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4732
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3356
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1568
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4584
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4000
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4504
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4836
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3328
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4796
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1340
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3784
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2576
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3200
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:404
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3188
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4124
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2876
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4128
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1348
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4028
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1828
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3860
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3868
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3288
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1380
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2196
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2288
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2540
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4324
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4416
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2528
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1480
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4764
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1612
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2136
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4488
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2672
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4220
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4856
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:756
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3816
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2092
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3880
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:452
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2880
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3740
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4232
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4120
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1720
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:880
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1108
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:528
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1776
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2040
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads