Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
5434d1eae761aff63d915370a62f0ca4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5434d1eae761aff63d915370a62f0ca4.exe
Resource
win10v2004-20231215-en
General
-
Target
5434d1eae761aff63d915370a62f0ca4.exe
-
Size
2.6MB
-
MD5
5434d1eae761aff63d915370a62f0ca4
-
SHA1
100d09ef2c9234cb66e2f92852fda15b01f783e7
-
SHA256
7f26224110a22c0c731c678913a228e7e981bfaa3e708d9c1a7477d1d20c396d
-
SHA512
8a519bc1307fff82b258d7f9da10b1b1fdbeb8a552a2476edfeade22bec7ca127299fb16d82fa25bb195582cf23ebe01283507c75dc7fe6a6d723963b1849833
-
SSDEEP
49152:bX8ferQZbd2ohLbOnBVj6yBw1z/HJfSoMfjDsgUp8Z6r6:xrQZ1O16y2VpfcbDsgo6
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" regedit.exe -
Blocks application from running via registry modification 17 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" regedit.exe -
Sets file execution options in registry 2 TTPs 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe regedit.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Option.bat 5434d1eae761aff63d915370a62f0ca4.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system\KavUpda.exe 5434d1eae761aff63d915370a62f0ca4.exe File created C:\Windows\Help\HelpCat.exe 5434d1eae761aff63d915370a62f0ca4.exe File opened for modification C:\Windows\Help\HelpCat.exe 5434d1eae761aff63d915370a62f0ca4.exe File created C:\Windows\Sysinf.bat 5434d1eae761aff63d915370a62f0ca4.exe File created C:\Windows\regedt32.sys 5434d1eae761aff63d915370a62f0ca4.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3504 sc.exe 2404 sc.exe 1728 sc.exe 2148 sc.exe 4584 sc.exe 4892 sc.exe 2312 sc.exe 3856 sc.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
pid Process 3336 regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5096 5434d1eae761aff63d915370a62f0ca4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5096 wrote to memory of 2980 5096 5434d1eae761aff63d915370a62f0ca4.exe 27 PID 5096 wrote to memory of 2980 5096 5434d1eae761aff63d915370a62f0ca4.exe 27 PID 5096 wrote to memory of 2980 5096 5434d1eae761aff63d915370a62f0ca4.exe 27 PID 5096 wrote to memory of 2792 5096 5434d1eae761aff63d915370a62f0ca4.exe 26 PID 5096 wrote to memory of 2792 5096 5434d1eae761aff63d915370a62f0ca4.exe 26 PID 5096 wrote to memory of 2792 5096 5434d1eae761aff63d915370a62f0ca4.exe 26 PID 2792 wrote to memory of 4084 2792 net.exe 20 PID 2792 wrote to memory of 4084 2792 net.exe 20 PID 2792 wrote to memory of 4084 2792 net.exe 20 PID 5096 wrote to memory of 3620 5096 5434d1eae761aff63d915370a62f0ca4.exe 107 PID 5096 wrote to memory of 3620 5096 5434d1eae761aff63d915370a62f0ca4.exe 107 PID 5096 wrote to memory of 3620 5096 5434d1eae761aff63d915370a62f0ca4.exe 107 PID 5096 wrote to memory of 4776 5096 5434d1eae761aff63d915370a62f0ca4.exe 106 PID 5096 wrote to memory of 4776 5096 5434d1eae761aff63d915370a62f0ca4.exe 106 PID 5096 wrote to memory of 4776 5096 5434d1eae761aff63d915370a62f0ca4.exe 106 PID 5096 wrote to memory of 4352 5096 5434d1eae761aff63d915370a62f0ca4.exe 105 PID 5096 wrote to memory of 4352 5096 5434d1eae761aff63d915370a62f0ca4.exe 105 PID 5096 wrote to memory of 4352 5096 5434d1eae761aff63d915370a62f0ca4.exe 105 PID 5096 wrote to memory of 2920 5096 5434d1eae761aff63d915370a62f0ca4.exe 104 PID 5096 wrote to memory of 2920 5096 5434d1eae761aff63d915370a62f0ca4.exe 104 PID 5096 wrote to memory of 2920 5096 5434d1eae761aff63d915370a62f0ca4.exe 104 PID 5096 wrote to memory of 2776 5096 5434d1eae761aff63d915370a62f0ca4.exe 102 PID 5096 wrote to memory of 2776 5096 5434d1eae761aff63d915370a62f0ca4.exe 102 PID 5096 wrote to memory of 2776 5096 5434d1eae761aff63d915370a62f0ca4.exe 102 PID 5096 wrote to memory of 1380 5096 5434d1eae761aff63d915370a62f0ca4.exe 100 PID 5096 wrote to memory of 1380 5096 5434d1eae761aff63d915370a62f0ca4.exe 100 PID 5096 wrote to memory of 1380 5096 5434d1eae761aff63d915370a62f0ca4.exe 100 PID 5096 wrote to memory of 740 5096 5434d1eae761aff63d915370a62f0ca4.exe 97 PID 5096 wrote to memory of 740 5096 5434d1eae761aff63d915370a62f0ca4.exe 97 PID 5096 wrote to memory of 740 5096 5434d1eae761aff63d915370a62f0ca4.exe 97 PID 5096 wrote to memory of 4832 5096 5434d1eae761aff63d915370a62f0ca4.exe 94 PID 5096 wrote to memory of 4832 5096 5434d1eae761aff63d915370a62f0ca4.exe 94 PID 5096 wrote to memory of 4832 5096 5434d1eae761aff63d915370a62f0ca4.exe 94 PID 5096 wrote to memory of 3504 5096 5434d1eae761aff63d915370a62f0ca4.exe 92 PID 5096 wrote to memory of 3504 5096 5434d1eae761aff63d915370a62f0ca4.exe 92 PID 5096 wrote to memory of 3504 5096 5434d1eae761aff63d915370a62f0ca4.exe 92 PID 5096 wrote to memory of 3856 5096 5434d1eae761aff63d915370a62f0ca4.exe 231 PID 5096 wrote to memory of 3856 5096 5434d1eae761aff63d915370a62f0ca4.exe 231 PID 5096 wrote to memory of 3856 5096 5434d1eae761aff63d915370a62f0ca4.exe 231 PID 5096 wrote to memory of 2312 5096 5434d1eae761aff63d915370a62f0ca4.exe 89 PID 5096 wrote to memory of 2312 5096 5434d1eae761aff63d915370a62f0ca4.exe 89 PID 5096 wrote to memory of 2312 5096 5434d1eae761aff63d915370a62f0ca4.exe 89 PID 5096 wrote to memory of 4892 5096 5434d1eae761aff63d915370a62f0ca4.exe 148 PID 5096 wrote to memory of 4892 5096 5434d1eae761aff63d915370a62f0ca4.exe 148 PID 5096 wrote to memory of 4892 5096 5434d1eae761aff63d915370a62f0ca4.exe 148 PID 5096 wrote to memory of 3336 5096 5434d1eae761aff63d915370a62f0ca4.exe 68 PID 5096 wrote to memory of 3336 5096 5434d1eae761aff63d915370a62f0ca4.exe 68 PID 5096 wrote to memory of 3336 5096 5434d1eae761aff63d915370a62f0ca4.exe 68 PID 5096 wrote to memory of 3144 5096 5434d1eae761aff63d915370a62f0ca4.exe 85 PID 5096 wrote to memory of 3144 5096 5434d1eae761aff63d915370a62f0ca4.exe 85 PID 5096 wrote to memory of 3144 5096 5434d1eae761aff63d915370a62f0ca4.exe 85 PID 5096 wrote to memory of 4800 5096 5434d1eae761aff63d915370a62f0ca4.exe 84 PID 5096 wrote to memory of 4800 5096 5434d1eae761aff63d915370a62f0ca4.exe 84 PID 5096 wrote to memory of 4800 5096 5434d1eae761aff63d915370a62f0ca4.exe 84 PID 4352 wrote to memory of 3056 4352 cmd.exe 82 PID 4352 wrote to memory of 3056 4352 cmd.exe 82 PID 4352 wrote to memory of 3056 4352 cmd.exe 82 PID 4776 wrote to memory of 3088 4776 cmd.exe 81 PID 4776 wrote to memory of 3088 4776 cmd.exe 81 PID 4776 wrote to memory of 3088 4776 cmd.exe 81 PID 1380 wrote to memory of 2148 1380 net.exe 151 PID 1380 wrote to memory of 2148 1380 net.exe 151 PID 1380 wrote to memory of 2148 1380 net.exe 151 PID 2920 wrote to memory of 4640 2920 net.exe 152 -
Views/modifies file attributes 1 TTPs 16 IoCs
pid Process 5052 attrib.exe 1388 attrib.exe 3764 attrib.exe 4896 attrib.exe 1104 attrib.exe 2800 attrib.exe 1848 attrib.exe 4444 attrib.exe 3648 attrib.exe 4676 attrib.exe 320 attrib.exe 2136 attrib.exe 4172 attrib.exe 3424 attrib.exe 3856 attrib.exe 2988 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5434d1eae761aff63d915370a62f0ca4.exe"C:\Users\Admin\AppData\Local\Temp\5434d1eae761aff63d915370a62f0ca4.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\net.exenet.exe start schedule /y2⤵
- Suspicious use of WriteProcessMemory
PID:2792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat2⤵PID:2980
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\regedt32.sys2⤵
- Modifies visibility of file extensions in Explorer
- Blocks application from running via registry modification
- Sets file execution options in registry
- Runs regedit.exe
PID:3336
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe2⤵PID:676
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:2404
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:1728
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2600
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4796
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:4076
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:4892
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled3⤵
- Launches sc.exe
PID:2148
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:4584
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y3⤵PID:1120
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y3⤵PID:1632
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y3⤵PID:2156
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2220
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y3⤵PID:4828
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y3⤵PID:3864
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:03:35 AM C:\Windows\Sysinf.bat3⤵PID:2860
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:00:35 AM C:\Windows\Sysinf.bat3⤵PID:2628
-
-
C:\Windows\SysWOW64\At.exeAt.exe 8:01:33 AM C:\Windows\Help\HelpCat.exe3⤵PID:4444
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:4532
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:5068
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2800
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2348
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1212
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3924
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4252
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2712
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4472
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1848
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3032
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2928
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4204
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3900
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4228
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4916
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4832
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:4576
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3800
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4444
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3812
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2192
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4536
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:5068
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2180
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2852
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:116
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2652
-
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:4800
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:3144
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:4892
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2312
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled2⤵
- Launches sc.exe
PID:3856
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:3504
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:4832
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵
- Views/modifies file attributes
PID:1388
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:740
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵
- Suspicious use of WriteProcessMemory
PID:1380
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:2776
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:2920
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:03:32 AM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4352
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:00:32 AM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4776
-
-
C:\Windows\SysWOW64\At.exeAt.exe 8:01:30 AM C:\Windows\Help\HelpCat.exe2⤵PID:3620
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:2532
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:4048
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵PID:1712
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:4872
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:4472
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵
- Views/modifies file attributes
PID:4444
-
-
-
C:\Users\Admin\AppData\Local\Temp\5434d1eae761aff63d915370a62f0ca4~4.exe5434d1eae761aff63d915370a62f0ca4~4.exe2⤵PID:5108
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:4084
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:3492
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:2624
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:5024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:2740
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y1⤵PID:1340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat1⤵PID:4344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:4640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:2148
-
C:\Windows\SysWOW64\at.exeat 8:00:32 AM C:\Windows\Sysinf.bat1⤵PID:3088
-
C:\Windows\SysWOW64\at.exeat 8:03:32 AM C:\Windows\Sysinf.bat1⤵PID:3056
-
C:\Windows\SysWOW64\at.exeat 8:00:35 AM C:\Windows\Sysinf.bat1⤵PID:4516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:1524
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d2⤵
- Views/modifies file attributes
PID:320
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:3324
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:4884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:4812
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:4244
-
C:\Windows\SysWOW64\at.exeat 8:03:35 AM C:\Windows\Sysinf.bat1⤵PID:4328
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1104
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:4296
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:5024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:1644
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:2232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:4184
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4640
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4172
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:5052
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1848
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3424
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3856
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3648
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4676
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3764
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4896
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2136
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD522a316980591d3a43854302951995de1
SHA1b5326d9817963246fa4654baa380fd8b397be740
SHA256937dc2edb9a986b4f58ee0b1d70e61b6cf9c8b70b4e195ac11015b6fd307cc73
SHA51284820477c90c9708cba15b8261e2fcefcfa9c70cc48a2970842f951273871259575e8307788744062d72db6a767382cecc0a009709c07fcedd9748f0a170564e
-
Filesize
1024KB
MD55376f51c1fdf79cd7e385acfeffe5d8b
SHA1f167c998cba73fa7fe3eff6bf465000aae53d29f
SHA256948b6029bea67e268364528fc4968db5d09c6e7a503d01436ef37c496fc8f325
SHA512cd44ca2044c4317f7708bec008fd6127a0d8d9603bc18192110e0d7d03cff4df3a383d5a81c530b4775f7ca2ca3a0ee6c72f64e070262bcfc6bfaa6604875d0a
-
Filesize
460B
MD57db3d565d6ddbe65a8b0e093910e7dcd
SHA1d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA256a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
SHA5120b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b
-
Filesize
382KB
MD593bb23bed9d99dfc93b9d75bd1a1ea6a
SHA19ceb632da913825394ec6462640609c69bc095a2
SHA2569072933ec09f9d0851d78ccdf5759b9e91f97aaeca73022a59374114ed0d336f
SHA51293bcbecc451df9dbe5711c63eda223464b36b4cf7108d8011e149f3d4a32a1c4c99f68bb454f4056d282fa08b0a890140587fbc5924d50067c96686fbc8e33b9
-
Filesize
2KB
MD5e7d7ec66bd61fac3843c98650b0c68f6
SHA1a15ae06e1be51038863650746368a71024539bac
SHA2566475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
SHA512ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6
-
Filesize
237B
MD594bcd02c5afd5918b4446345e7a5ded9
SHA179839238e84be225132e1382fae6333dfc4906a1
SHA2565d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1
SHA512149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500