1d52b44a08936ba0bda9340e6247fa036c85d463b530dde3730ea363f68dcbea

Analysis

max time kernel
151s
max time network
144s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[[[[..bat
Size

333B
MD5

8364e526760fe3a0b16b471f7e0b6578
SHA1

85fc404641a20c765bb0bd80f6c4d859fb5c8559
SHA256

1d52b44a08936ba0bda9340e6247fa036c85d463b530dde3730ea363f68dcbea
SHA512

deae05b4f217349a9d724b357218a525d19c1dfda8c00c7ea3fbb8cbd2e5f60df3d04665a1241d89d690d6425ddcbe10febfda51b086db8ed0dfcfdd7b4c4e66

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 47 IoCs

evasion

pid	Process
2120	timeout.exe
1384	timeout.exe
2108	timeout.exe
2892	timeout.exe
1220	timeout.exe
1020	timeout.exe
756	timeout.exe
1788	timeout.exe
1324	timeout.exe
1876	timeout.exe
2552	timeout.exe
304	timeout.exe
1384	timeout.exe
988	timeout.exe
1936	timeout.exe
1652	timeout.exe
2704	timeout.exe
756	timeout.exe
1040	timeout.exe
2824	timeout.exe
1524	timeout.exe
2404	timeout.exe
2068	timeout.exe
2252	timeout.exe
1936	timeout.exe
676	timeout.exe
584	timeout.exe
2764	timeout.exe
2808	timeout.exe
1172	timeout.exe
2252	timeout.exe
1304	timeout.exe
652	timeout.exe
2656	timeout.exe
1296	timeout.exe
2180	timeout.exe
2856	timeout.exe
1316	timeout.exe
2660	timeout.exe
2836	timeout.exe
2528	timeout.exe
2172	timeout.exe
2984	timeout.exe
2164	timeout.exe
2712	timeout.exe
628	timeout.exe
2972	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 652	3068	cmd.exe	29
PID 3068 wrote to memory of 652	3068	cmd.exe	29
PID 3068 wrote to memory of 652	3068	cmd.exe	29
PID 3068 wrote to memory of 1700	3068	cmd.exe	30
PID 3068 wrote to memory of 1700	3068	cmd.exe	30
PID 3068 wrote to memory of 1700	3068	cmd.exe	30
PID 3068 wrote to memory of 2108	3068	cmd.exe	31
PID 3068 wrote to memory of 2108	3068	cmd.exe	31
PID 3068 wrote to memory of 2108	3068	cmd.exe	31
PID 3068 wrote to memory of 1028	3068	cmd.exe	32
PID 3068 wrote to memory of 1028	3068	cmd.exe	32
PID 3068 wrote to memory of 1028	3068	cmd.exe	32
PID 3068 wrote to memory of 1768	3068	cmd.exe	33
PID 3068 wrote to memory of 1768	3068	cmd.exe	33
PID 3068 wrote to memory of 1768	3068	cmd.exe	33
PID 3068 wrote to memory of 2940	3068	cmd.exe	34
PID 3068 wrote to memory of 2940	3068	cmd.exe	34
PID 3068 wrote to memory of 2940	3068	cmd.exe	34
PID 3068 wrote to memory of 2608	3068	cmd.exe	35
PID 3068 wrote to memory of 2608	3068	cmd.exe	35
PID 3068 wrote to memory of 2608	3068	cmd.exe	35
PID 3068 wrote to memory of 2404	3068	cmd.exe	36
PID 3068 wrote to memory of 2404	3068	cmd.exe	36
PID 3068 wrote to memory of 2404	3068	cmd.exe	36
PID 3068 wrote to memory of 2284	3068	cmd.exe	37
PID 3068 wrote to memory of 2284	3068	cmd.exe	37
PID 3068 wrote to memory of 2284	3068	cmd.exe	37
PID 3068 wrote to memory of 2640	3068	cmd.exe	38
PID 3068 wrote to memory of 2640	3068	cmd.exe	38
PID 3068 wrote to memory of 2640	3068	cmd.exe	38
PID 3068 wrote to memory of 2788	3068	cmd.exe	39
PID 3068 wrote to memory of 2788	3068	cmd.exe	39
PID 3068 wrote to memory of 2788	3068	cmd.exe	39
PID 3068 wrote to memory of 2796	3068	cmd.exe	40
PID 3068 wrote to memory of 2796	3068	cmd.exe	40
PID 3068 wrote to memory of 2796	3068	cmd.exe	40
PID 3068 wrote to memory of 2832	3068	cmd.exe	41
PID 3068 wrote to memory of 2832	3068	cmd.exe	41
PID 3068 wrote to memory of 2832	3068	cmd.exe	41
PID 3068 wrote to memory of 2664	3068	cmd.exe	42
PID 3068 wrote to memory of 2664	3068	cmd.exe	42
PID 3068 wrote to memory of 2664	3068	cmd.exe	42
PID 3068 wrote to memory of 2656	3068	cmd.exe	43
PID 3068 wrote to memory of 2656	3068	cmd.exe	43
PID 3068 wrote to memory of 2656	3068	cmd.exe	43
PID 3068 wrote to memory of 2620	3068	cmd.exe	44
PID 3068 wrote to memory of 2620	3068	cmd.exe	44
PID 3068 wrote to memory of 2620	3068	cmd.exe	44
PID 3068 wrote to memory of 2820	3068	cmd.exe	45
PID 3068 wrote to memory of 2820	3068	cmd.exe	45
PID 3068 wrote to memory of 2820	3068	cmd.exe	45
PID 3068 wrote to memory of 2780	3068	cmd.exe	46
PID 3068 wrote to memory of 2780	3068	cmd.exe	46
PID 3068 wrote to memory of 2780	3068	cmd.exe	46
PID 3068 wrote to memory of 2712	3068	cmd.exe	47
PID 3068 wrote to memory of 2712	3068	cmd.exe	47
PID 3068 wrote to memory of 2712	3068	cmd.exe	47
PID 3068 wrote to memory of 2956	3068	cmd.exe	48
PID 3068 wrote to memory of 2956	3068	cmd.exe	48
PID 3068 wrote to memory of 2956	3068	cmd.exe	48
PID 3068 wrote to memory of 2804	3068	cmd.exe	49
PID 3068 wrote to memory of 2804	3068	cmd.exe	49
PID 3068 wrote to memory of 2804	3068	cmd.exe	49
PID 3068 wrote to memory of 2552	3068	cmd.exe	50

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\[[[[..bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:652
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1700
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2108
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1028
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1768
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2940
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2608
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2404
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2284
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2640
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2788
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2796
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2832
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2664
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2656
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2620
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2820
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2780
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2712
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2956
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2804
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2552
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2916
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2892
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2772
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2684
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2560
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2516
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2528
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:3052
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1876
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2028
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1356
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2844
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1440
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2172
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2412
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1556
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2488
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2180
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2756
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2008
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1020
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1976
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1236
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1520
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2856
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2736
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2836
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:676
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:472
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:436
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2748
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1284
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1344
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1304
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1296
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1180
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2912
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2884
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2724
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2896
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2696
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:584
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:568
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2136
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2292
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2556
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1808
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:112
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2068
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2932
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1920
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1108
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1492
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1860
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1536
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:304
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2920
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1092
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1656
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:396
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2360
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2152
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2984
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1088
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2416
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1764
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:872
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1692
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1380
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1936
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1636
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:956
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1620
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:984
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:536
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1992
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:756
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1752
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:896
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1156
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:884
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1948
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:3028
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1384
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2344
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1160
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2336
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2600
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1996
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1496
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2252
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2288
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2212
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2240
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2236
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1748
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1664
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:988
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2036
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1600
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1612
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1040
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2056
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1852
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1652
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1648
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1676
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2092
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1672
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1984
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2700
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2164
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2940
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2608
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2652
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2760
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2792
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2828
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2764
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2832
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2664
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2656
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2620
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2820
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2780
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2712
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2956
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2804
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2540
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2000
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2676
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2680
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2808
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2560
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2516
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2500
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1796
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1680
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:852
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2704
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2844
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1440
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2172
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2412
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2488
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1556
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2180
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2504
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1704
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1020
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1976
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1236
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1520
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2856
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2836
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:572
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1940
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:824
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1632
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2872
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1316
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1304
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1772
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1916
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2904
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2876
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2928
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1172
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2864
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2064
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2016
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2340
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2612
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1804
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2120
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:3032
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:3056
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1640
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1484
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1972
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2296
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:628
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2900
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1864
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1544
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1004
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:780
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2980
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2972
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2880
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2564
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2592
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2548
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1240
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1144
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1788
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2416
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1764
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:872
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1692
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1380
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2576
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1936
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:300
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1352
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:776
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1872
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:384
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:240
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:756
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:812
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:944
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1644
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:600
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:688
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2316
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1384
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2156
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2472
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2176
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2220
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2052
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1124
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2252
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1956
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1036
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:1756
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:880
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1660
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1064
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1324
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:836
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2388
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2492
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1568
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2480
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1612
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1040
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2056
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1852
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2384
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2324
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:3008
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2024
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2108
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1672
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1984
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2700
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1740
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2404
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2284
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2660
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2760
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2792
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2828
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2668
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2636
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1624
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2824
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2620
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2820
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2780
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2816
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2544
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2916
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2892
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2000
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2676
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2680
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2520
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2528
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:3052
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1876
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:1796
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1680
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:852
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2448
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1820
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2424
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1524
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2412
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1556
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2488
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:892
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:1572
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1616
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1220
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:2728
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:2720
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:2280
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:2744
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:920
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:2856
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:2836
- C:\Windows\system32\msg.exe
  msg * Press Ctrl+C to exit.
  2⤵
  PID:572
- C:\Windows\system32\msg.exe
  msg * you have successfully downloaded porn
  2⤵
  PID:1940
- C:\Windows\system32\msg.exe
  msg * you are retarded
  2⤵
  PID:824
- C:\Windows\system32\msg.exe
  msg * please kys now u worthless pedo
  2⤵
  PID:1632
- C:\Windows\system32\msg.exe
  msg * what would your mother think?
  2⤵
  PID:2872
- C:\Windows\system32\msg.exe
  msg * tell your family I said hey
  2⤵
  PID:1316
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1304

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads