13c2aa5ca100baa99a29c4f64bc34de3adf233f29a534b6fd4b48dbaf1a5b980

Analysis

max time kernel
194s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

n.bat
Size

1KB
MD5

d5ce90e602b989f97cfd5084c6a2fdaf
SHA1

47351df94a7af039d917ee06fe8921960b5527ed
SHA256

13c2aa5ca100baa99a29c4f64bc34de3adf233f29a534b6fd4b48dbaf1a5b980
SHA512

04129caddc0d134482254bfee7526bea3c604767aa5fdc66b2098ddc157d86f9e4d89b604cc083021dd33caffdd6615749ecb18e273ce76371be261d022dbb2a

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
3696	timeout.exe
1068	timeout.exe
876	timeout.exe
3332	timeout.exe
3872	timeout.exe
4128	timeout.exe
3996	timeout.exe
2540	timeout.exe
3820	timeout.exe
2168	timeout.exe
2592	timeout.exe
2440	timeout.exe
2956	timeout.exe
4088	timeout.exe
3636	timeout.exe
4148	timeout.exe
1272	timeout.exe
2824	timeout.exe
4952	timeout.exe
2268	timeout.exe
744	timeout.exe
4952	timeout.exe
4180	timeout.exe
2036	timeout.exe
2112	timeout.exe
3860	timeout.exe
4484	timeout.exe
716	timeout.exe
3352	timeout.exe
1468	timeout.exe
2136	timeout.exe
3372	timeout.exe
4744	timeout.exe
4632	timeout.exe
4600	timeout.exe
2228	timeout.exe
5080	timeout.exe
620	timeout.exe
4004	timeout.exe
2588	timeout.exe
4128	timeout.exe
3568	timeout.exe
2988	timeout.exe
2380	timeout.exe
2580	timeout.exe
4936	timeout.exe
1108	timeout.exe
1256	timeout.exe
3204	timeout.exe
404	timeout.exe
924	timeout.exe
4320	timeout.exe
4424	timeout.exe
3308	timeout.exe
4448	timeout.exe
1028	timeout.exe
4560	timeout.exe
3300	timeout.exe
2228	timeout.exe
3152	timeout.exe
4084	timeout.exe
1840	timeout.exe
4936	timeout.exe
2376	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1500	1428	cmd.exe	85
PID 1428 wrote to memory of 1500	1428	cmd.exe	85
PID 1428 wrote to memory of 4448	1428	cmd.exe	87
PID 1428 wrote to memory of 4448	1428	cmd.exe	87
PID 1428 wrote to memory of 3392	1428	cmd.exe	88
PID 1428 wrote to memory of 3392	1428	cmd.exe	88
PID 1428 wrote to memory of 4004	1428	cmd.exe	91
PID 1428 wrote to memory of 4004	1428	cmd.exe	91
PID 1428 wrote to memory of 3932	1428	cmd.exe	92
PID 1428 wrote to memory of 3932	1428	cmd.exe	92
PID 1428 wrote to memory of 4148	1428	cmd.exe	93
PID 1428 wrote to memory of 4148	1428	cmd.exe	93
PID 1428 wrote to memory of 4360	1428	cmd.exe	94
PID 1428 wrote to memory of 4360	1428	cmd.exe	94
PID 1428 wrote to memory of 4880	1428	cmd.exe	95
PID 1428 wrote to memory of 4880	1428	cmd.exe	95
PID 1428 wrote to memory of 4872	1428	cmd.exe	96
PID 1428 wrote to memory of 4872	1428	cmd.exe	96
PID 1428 wrote to memory of 2540	1428	cmd.exe	97
PID 1428 wrote to memory of 2540	1428	cmd.exe	97
PID 1428 wrote to memory of 468	1428	cmd.exe	98
PID 1428 wrote to memory of 468	1428	cmd.exe	98
PID 1428 wrote to memory of 4180	1428	cmd.exe	99
PID 1428 wrote to memory of 4180	1428	cmd.exe	99
PID 1428 wrote to memory of 3980	1428	cmd.exe	100
PID 1428 wrote to memory of 3980	1428	cmd.exe	100
PID 1428 wrote to memory of 3572	1428	cmd.exe	101
PID 1428 wrote to memory of 3572	1428	cmd.exe	101
PID 1428 wrote to memory of 3232	1428	cmd.exe	102
PID 1428 wrote to memory of 3232	1428	cmd.exe	102
PID 1428 wrote to memory of 3820	1428	cmd.exe	103
PID 1428 wrote to memory of 3820	1428	cmd.exe	103
PID 1428 wrote to memory of 4176	1428	cmd.exe	104
PID 1428 wrote to memory of 4176	1428	cmd.exe	104
PID 1428 wrote to memory of 2376	1428	cmd.exe	105
PID 1428 wrote to memory of 2376	1428	cmd.exe	105
PID 1428 wrote to memory of 2088	1428	cmd.exe	106
PID 1428 wrote to memory of 2088	1428	cmd.exe	106
PID 1428 wrote to memory of 3396	1428	cmd.exe	107
PID 1428 wrote to memory of 3396	1428	cmd.exe	107
PID 1428 wrote to memory of 2200	1428	cmd.exe	108
PID 1428 wrote to memory of 2200	1428	cmd.exe	108
PID 1428 wrote to memory of 2136	1428	cmd.exe	109
PID 1428 wrote to memory of 2136	1428	cmd.exe	109
PID 1428 wrote to memory of 3404	1428	cmd.exe	110
PID 1428 wrote to memory of 3404	1428	cmd.exe	110
PID 1428 wrote to memory of 1028	1428	cmd.exe	111
PID 1428 wrote to memory of 1028	1428	cmd.exe	111
PID 1428 wrote to memory of 1564	1428	cmd.exe	112
PID 1428 wrote to memory of 1564	1428	cmd.exe	112
PID 1428 wrote to memory of 3900	1428	cmd.exe	113
PID 1428 wrote to memory of 3900	1428	cmd.exe	113
PID 1428 wrote to memory of 3172	1428	cmd.exe	114
PID 1428 wrote to memory of 3172	1428	cmd.exe	114
PID 1428 wrote to memory of 3428	1428	cmd.exe	115
PID 1428 wrote to memory of 3428	1428	cmd.exe	115
PID 1428 wrote to memory of 4160	1428	cmd.exe	116
PID 1428 wrote to memory of 4160	1428	cmd.exe	116
PID 1428 wrote to memory of 744	1428	cmd.exe	117
PID 1428 wrote to memory of 744	1428	cmd.exe	117
PID 1428 wrote to memory of 2620	1428	cmd.exe	118
PID 1428 wrote to memory of 2620	1428	cmd.exe	118
PID 1428 wrote to memory of 4352	1428	cmd.exe	119
PID 1428 wrote to memory of 4352	1428	cmd.exe	119

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4448	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\n.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1500
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\n.bat
  2⤵
  - Views/modifies file attributes
  PID:4448
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3392
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4004
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3932
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4148
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4360
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4880
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4872
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2540
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:468
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4180
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3980
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3572
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3232
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3820
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4176
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2376
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2088
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3396
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2200
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2136
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3404
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1028
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1564
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3900
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3172
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3428
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4160
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:744
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2620
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4352
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1808
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1068
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1984
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4144
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1456
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:404
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:5012
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1116
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4216
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4364
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3336
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:620
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4380
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:876
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4188
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1684
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1952
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3372
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:5032
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2588
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:5028
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2580
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:380
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4744
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1572
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3828
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1368
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4312
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1500
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4448
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:5056
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:716
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2808
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2368
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2892
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2228
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:464
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4128
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3936
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4204
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3352
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4316
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4520
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1028
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1564
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1404
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4632
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4532
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3456
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2792
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4936
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1808
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4600
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1580
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1072
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2956
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3332
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:876
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4188
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:904
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3872
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:5028
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2692
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1468
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:924
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:624
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2168
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:708
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1256
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4312
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2036
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3952
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2592
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:5056
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2596
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:388
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2444
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4620
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3152
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1408
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4712
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4092
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4128
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4680
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4560
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4204
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3860
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3300
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3352
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4344
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2408
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4952
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:436
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3204
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3576
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4156
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3296
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4320
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2704
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4088
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4420
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1068
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1984
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2440
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3260
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2956
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3964
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1272
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2884
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4484
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2732
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:228
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3672
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:756
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2312
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4780
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3344
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3696
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1040
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2112
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2940
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1292
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:616
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1492
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4448
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:964
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3568
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2628
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2824
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2780
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2228
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4404
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4424
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1512
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2028
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2484
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4128
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4680
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1616
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4684
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2696
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2016
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2988
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4488
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2380
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1988
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2900
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4732
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4952
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4316
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3636
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4520
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1028
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3920
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3996
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:736
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1752
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4372
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:32
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4420
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1068
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1984
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4308
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4184
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1108
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4576
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4084
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4984
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1840
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:1404
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4936
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3332
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5080
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3220
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2268
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1468
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:4908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1284
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:3952
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3308
- C:\Windows\system32\mode.com
  mode con cols=120 lines=50
  2⤵
  PID:2596
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads