13c2aa5ca100baa99a29c4f64bc34de3adf233f29a534b6fd4b48dbaf1a5b980

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

n.bat
Size

1KB
MD5

d5ce90e602b989f97cfd5084c6a2fdaf
SHA1

47351df94a7af039d917ee06fe8921960b5527ed
SHA256

13c2aa5ca100baa99a29c4f64bc34de3adf233f29a534b6fd4b48dbaf1a5b980
SHA512

04129caddc0d134482254bfee7526bea3c604767aa5fdc66b2098ddc157d86f9e4d89b604cc083021dd33caffdd6615749ecb18e273ce76371be261d022dbb2a

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2812	timeout.exe
2852	timeout.exe
2840	timeout.exe
2400	timeout.exe
2964	timeout.exe
2396	timeout.exe
2652	timeout.exe
544	timeout.exe
1796	timeout.exe
2580	timeout.exe
2860	timeout.exe
2268	timeout.exe
2052	timeout.exe
1492	timeout.exe
1932	timeout.exe
2900	timeout.exe
3056	timeout.exe
1316	timeout.exe
2956	timeout.exe
1308	timeout.exe
2548	timeout.exe
392	timeout.exe
2132	timeout.exe
2696	timeout.exe
2660	timeout.exe
2516	timeout.exe
2912	timeout.exe
1332	timeout.exe
1084	timeout.exe
2348	timeout.exe
1996	timeout.exe
2612	timeout.exe
2380	timeout.exe
2036	timeout.exe
2664	timeout.exe
2576	timeout.exe
1208	timeout.exe
892	timeout.exe
788	timeout.exe
2440	timeout.exe
1344	timeout.exe
664	timeout.exe
1564	timeout.exe
1164	timeout.exe
900	timeout.exe
2704	timeout.exe
2956	timeout.exe
476	timeout.exe
692	timeout.exe
3012	timeout.exe
2188	timeout.exe
2364	timeout.exe
1352	timeout.exe
2328	timeout.exe
3020	timeout.exe
3008	timeout.exe
628	timeout.exe
2400	timeout.exe
344	timeout.exe
2804	timeout.exe
1536	timeout.exe
1748	timeout.exe
2980	timeout.exe
1356	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2320	2020	cmd.exe	29
PID 2020 wrote to memory of 2320	2020	cmd.exe	29
PID 2020 wrote to memory of 2320	2020	cmd.exe	29
PID 2020 wrote to memory of 2284	2020	cmd.exe	30
PID 2020 wrote to memory of 2284	2020	cmd.exe	30
PID 2020 wrote to memory of 2284	2020	cmd.exe	30
PID 2020 wrote to memory of 2100	2020	cmd.exe	31
PID 2020 wrote to memory of 2100	2020	cmd.exe	31
PID 2020 wrote to memory of 2100	2020	cmd.exe	31
PID 2020 wrote to memory of 2400	2020	cmd.exe	32
PID 2020 wrote to memory of 2400	2020	cmd.exe	32
PID 2020 wrote to memory of 2400	2020	cmd.exe	32
PID 2020 wrote to memory of 1048	2020	cmd.exe	33
PID 2020 wrote to memory of 1048	2020	cmd.exe	33
PID 2020 wrote to memory of 1048	2020	cmd.exe	33
PID 2020 wrote to memory of 2036	2020	cmd.exe	34
PID 2020 wrote to memory of 2036	2020	cmd.exe	34
PID 2020 wrote to memory of 2036	2020	cmd.exe	34
PID 2020 wrote to memory of 2628	2020	cmd.exe	35
PID 2020 wrote to memory of 2628	2020	cmd.exe	35
PID 2020 wrote to memory of 2628	2020	cmd.exe	35
PID 2020 wrote to memory of 2656	2020	cmd.exe	36
PID 2020 wrote to memory of 2656	2020	cmd.exe	36
PID 2020 wrote to memory of 2656	2020	cmd.exe	36
PID 2020 wrote to memory of 2700	2020	cmd.exe	37
PID 2020 wrote to memory of 2700	2020	cmd.exe	37
PID 2020 wrote to memory of 2700	2020	cmd.exe	37
PID 2020 wrote to memory of 2704	2020	cmd.exe	38
PID 2020 wrote to memory of 2704	2020	cmd.exe	38
PID 2020 wrote to memory of 2704	2020	cmd.exe	38
PID 2020 wrote to memory of 2720	2020	cmd.exe	39
PID 2020 wrote to memory of 2720	2020	cmd.exe	39
PID 2020 wrote to memory of 2720	2020	cmd.exe	39
PID 2020 wrote to memory of 2784	2020	cmd.exe	40
PID 2020 wrote to memory of 2784	2020	cmd.exe	40
PID 2020 wrote to memory of 2784	2020	cmd.exe	40
PID 2020 wrote to memory of 2968	2020	cmd.exe	41
PID 2020 wrote to memory of 2968	2020	cmd.exe	41
PID 2020 wrote to memory of 2968	2020	cmd.exe	41
PID 2020 wrote to memory of 2652	2020	cmd.exe	42
PID 2020 wrote to memory of 2652	2020	cmd.exe	42
PID 2020 wrote to memory of 2652	2020	cmd.exe	42
PID 2020 wrote to memory of 2604	2020	cmd.exe	43
PID 2020 wrote to memory of 2604	2020	cmd.exe	43
PID 2020 wrote to memory of 2604	2020	cmd.exe	43
PID 2020 wrote to memory of 2956	2020	cmd.exe	44
PID 2020 wrote to memory of 2956	2020	cmd.exe	44
PID 2020 wrote to memory of 2956	2020	cmd.exe	44
PID 2020 wrote to memory of 2732	2020	cmd.exe	45
PID 2020 wrote to memory of 2732	2020	cmd.exe	45
PID 2020 wrote to memory of 2732	2020	cmd.exe	45
PID 2020 wrote to memory of 2748	2020	cmd.exe	46
PID 2020 wrote to memory of 2748	2020	cmd.exe	46
PID 2020 wrote to memory of 2748	2020	cmd.exe	46
PID 2020 wrote to memory of 2512	2020	cmd.exe	47
PID 2020 wrote to memory of 2512	2020	cmd.exe	47
PID 2020 wrote to memory of 2512	2020	cmd.exe	47
PID 2020 wrote to memory of 2156	2020	cmd.exe	48
PID 2020 wrote to memory of 2156	2020	cmd.exe	48
PID 2020 wrote to memory of 2156	2020	cmd.exe	48
PID 2020 wrote to memory of 2744	2020	cmd.exe	49
PID 2020 wrote to memory of 2744	2020	cmd.exe	49
PID 2020 wrote to memory of 2744	2020	cmd.exe	49
PID 2020 wrote to memory of 2616	2020	cmd.exe	50

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2284	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\n.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2320
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\n.bat
  2⤵
  - Views/modifies file attributes
  PID:2284
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2100
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2400
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1048
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2036
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2628
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2656
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2700
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2704
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2720
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2784
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2968
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2652
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2604
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2956
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2732
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2748
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2512
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2156
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2744
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2616
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2792
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2072
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2672
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2532
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2888
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2528
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1204
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2664
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2560
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2776
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2504
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2500
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2520
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2780
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2536
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2576
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:688
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3056
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3060
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2564
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2380
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1208
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2488
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:324
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:892
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:528
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:564
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:664
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:476
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:788
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:320
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1236
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1044
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:344
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1352
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1356
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1252
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1308
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2892
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2896
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2860
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2764
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2816
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2796
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2800
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2844
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1220
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1900
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1216
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1700
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2000
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2868
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2832
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1136
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3044
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2676
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2912
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2856
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1924
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1916
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2108
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1532
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1636
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:848
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1632
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1536
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1488
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1768
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2392
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2328
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2352
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1316
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1092
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1456
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1972
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2420
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1096
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1748
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2044
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1984
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2356
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2964
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2976
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2980
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2112
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2132
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2184
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1716
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1828
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2600
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2016
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:628
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1104
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:400
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:840
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2080
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2396
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2076
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2332
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2004
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1040
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2824
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1800
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1504
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1832
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1808
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1332
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2060
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1480
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2376
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1564
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:972
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1164
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:812
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1936
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1840
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1844
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1224
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1660
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2452
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1836
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:900
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1064
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:604
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:552
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1960
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:544
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1496
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2440
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1712
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1732
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2344
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2424
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2480
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3020
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2260
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3008
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1016
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1964
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1200
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2348
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1684
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:876
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2128
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1584
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1976
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2120
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1764
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2336
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1616
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3024
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1612
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2292
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2324
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2268
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2584
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2400
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1048
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2152
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2708
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2712
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2724
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2788
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2696
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1484
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1796
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2256
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1084
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1416
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2652
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2604
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2956
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2684
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2952
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2716
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2660
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2540
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2668
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2240
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2864
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2928
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1112
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2640
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1996
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2568
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2612
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2508
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2516
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2524
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2548
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2556
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2580
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3052
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1108
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3064
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1572
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2564
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2380
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1208
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2488
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:324
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:892
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:528
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:564
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:664
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:476
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:788
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:692
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1236
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1044
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:344
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1352
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1356
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1252
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1308
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2932
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2880
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2936
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2772
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2756
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2812
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2848
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2836
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2008
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1932
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2472
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1080
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1292
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2808
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2884
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2876
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2904
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2920
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2900
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1012
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1924
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2108
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1532
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1636
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1680
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2804
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3048
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2852
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1420
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2840
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1520
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1476
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2028
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2136
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2280
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2360
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2544
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3012
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2116
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1072
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2872
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2760
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:836
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2052
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1640
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1344
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2768
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2984
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2972
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:620
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2248
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2188
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2024
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1492
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2012
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:392
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:952
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2996
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:436
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2372
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2388
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...