Analysis
-
max time kernel
2s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 16:31
Static task
static1
Behavioral task
behavioral1
Sample
7ce44a252c2d7ce227044036eea3c1a5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7ce44a252c2d7ce227044036eea3c1a5.exe
Resource
win10v2004-20231222-en
General
-
Target
7ce44a252c2d7ce227044036eea3c1a5.exe
-
Size
2.8MB
-
MD5
7ce44a252c2d7ce227044036eea3c1a5
-
SHA1
61d646b806e942fedf6e9658f6aecf728e803aea
-
SHA256
b27c91d51bee96429c77774034c158eedee14ee3aab72cf364d6de378f16f138
-
SHA512
4444fede6263586c87043aacf81d09d25286277ddbd90ae3ea311c38b3767debbe79d1872cf8637841f534c8ac139739f1fe147c620d3513e72d967418c77cdf
-
SSDEEP
49152:b4erQZbd2xerQZbd2xerQZbd2xerQZbd2I:NrQZfrQZfrQZfrQZj
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" regedit.exe -
Blocks application from running via registry modification 17 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" regedit.exe -
Sets file execution options in registry 2 TTPs 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Option.bat 7ce44a252c2d7ce227044036eea3c1a5.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\regedt32.sys 7ce44a252c2d7ce227044036eea3c1a5.exe File opened for modification C:\Windows\system\KavUpda.exe 7ce44a252c2d7ce227044036eea3c1a5.exe File created C:\Windows\Help\HelpCat.exe 7ce44a252c2d7ce227044036eea3c1a5.exe File opened for modification C:\Windows\Help\HelpCat.exe 7ce44a252c2d7ce227044036eea3c1a5.exe File created C:\Windows\Sysinf.bat 7ce44a252c2d7ce227044036eea3c1a5.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3904 sc.exe 752 sc.exe 4604 sc.exe 5084 sc.exe 2760 sc.exe 2236 sc.exe 3484 sc.exe 1144 sc.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
pid Process 4992 regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4784 7ce44a252c2d7ce227044036eea3c1a5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 3316 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 26 PID 4784 wrote to memory of 3316 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 26 PID 4784 wrote to memory of 3316 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 26 PID 4784 wrote to memory of 3720 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 154 PID 4784 wrote to memory of 3720 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 154 PID 4784 wrote to memory of 3720 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 154 PID 3720 wrote to memory of 4056 3720 at.exe 22 PID 3720 wrote to memory of 4056 3720 at.exe 22 PID 3720 wrote to memory of 4056 3720 at.exe 22 PID 4784 wrote to memory of 5072 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 115 PID 4784 wrote to memory of 5072 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 115 PID 4784 wrote to memory of 5072 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 115 PID 4784 wrote to memory of 4296 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 114 PID 4784 wrote to memory of 4296 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 114 PID 4784 wrote to memory of 4296 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 114 PID 4784 wrote to memory of 3780 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 113 PID 4784 wrote to memory of 3780 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 113 PID 4784 wrote to memory of 3780 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 113 PID 4784 wrote to memory of 4460 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 197 PID 4784 wrote to memory of 4460 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 197 PID 4784 wrote to memory of 4460 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 197 PID 4784 wrote to memory of 2252 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 110 PID 4784 wrote to memory of 2252 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 110 PID 4784 wrote to memory of 2252 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 110 PID 4784 wrote to memory of 3052 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 109 PID 4784 wrote to memory of 3052 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 109 PID 4784 wrote to memory of 3052 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 109 PID 4784 wrote to memory of 3324 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 108 PID 4784 wrote to memory of 3324 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 108 PID 4784 wrote to memory of 3324 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 108 PID 4784 wrote to memory of 1696 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 104 PID 4784 wrote to memory of 1696 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 104 PID 4784 wrote to memory of 1696 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 104 PID 4784 wrote to memory of 752 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 219 PID 4784 wrote to memory of 752 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 219 PID 4784 wrote to memory of 752 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 219 PID 4784 wrote to memory of 3904 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 100 PID 4784 wrote to memory of 3904 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 100 PID 4784 wrote to memory of 3904 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 100 PID 4784 wrote to memory of 1144 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 97 PID 4784 wrote to memory of 1144 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 97 PID 4784 wrote to memory of 1144 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 97 PID 4784 wrote to memory of 3484 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 140 PID 4784 wrote to memory of 3484 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 140 PID 4784 wrote to memory of 3484 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 140 PID 4784 wrote to memory of 4992 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 76 PID 4784 wrote to memory of 4992 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 76 PID 4784 wrote to memory of 4992 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 76 PID 4460 wrote to memory of 3676 4460 cmd.exe 170 PID 4460 wrote to memory of 3676 4460 cmd.exe 170 PID 4460 wrote to memory of 3676 4460 cmd.exe 170 PID 4784 wrote to memory of 3692 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 79 PID 4784 wrote to memory of 3692 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 79 PID 4784 wrote to memory of 3692 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 79 PID 4784 wrote to memory of 3564 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 159 PID 4784 wrote to memory of 3564 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 159 PID 4784 wrote to memory of 3564 4784 7ce44a252c2d7ce227044036eea3c1a5.exe 159 PID 3052 wrote to memory of 3368 3052 net.exe 85 PID 3052 wrote to memory of 3368 3052 net.exe 85 PID 3052 wrote to memory of 3368 3052 net.exe 85 PID 2252 wrote to memory of 1016 2252 net.exe 221 PID 2252 wrote to memory of 1016 2252 net.exe 221 PID 2252 wrote to memory of 1016 2252 net.exe 221 PID 4296 wrote to memory of 4912 4296 cmd.exe 83 -
Views/modifies file attributes 1 TTPs 16 IoCs
pid Process 4948 attrib.exe 2120 attrib.exe 3648 attrib.exe 3192 attrib.exe 2920 attrib.exe 3796 attrib.exe 2940 attrib.exe 2112 attrib.exe 988 attrib.exe 752 attrib.exe 4584 attrib.exe 5008 attrib.exe 1016 attrib.exe 4200 attrib.exe 1028 attrib.exe 3096 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ce44a252c2d7ce227044036eea3c1a5.exe"C:\Users\Admin\AppData\Local\Temp\7ce44a252c2d7ce227044036eea3c1a5.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\net.exenet.exe start schedule /y2⤵PID:3720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat2⤵PID:3316
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:3484
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\regedt32.sys2⤵
- Modifies visibility of file extensions in Explorer
- Blocks application from running via registry modification
- Sets file execution options in registry
- Runs regedit.exe
PID:4992
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:3692
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe2⤵PID:4608
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y3⤵PID:3800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵PID:2096
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d5⤵
- Views/modifies file attributes
PID:3648
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat3⤵PID:2280
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2700
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2256
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:4676
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:1688
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:4604
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled3⤵
- Launches sc.exe
PID:5084
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:2760
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:2236
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y3⤵PID:3024
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y3⤵PID:4496
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y3⤵PID:1704
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y3⤵PID:1108
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y3⤵PID:2616
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:24:24 PM C:\Windows\Sysinf.bat3⤵PID:1292
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:21:24 PM C:\Windows\Sysinf.bat3⤵PID:4348
-
-
C:\Windows\SysWOW64\At.exeAt.exe 8:22:22 PM C:\Windows\Help\HelpCat.exe3⤵PID:2484
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4892
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵
- Suspicious use of WriteProcessMemory
PID:4460
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3956
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4740
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:384
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4840
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3144
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:912
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:3396
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4564
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:4556
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2688
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2948
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:944
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3476
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3552
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:3696
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1304
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:220
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4580
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1028
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4544
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1124
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2212
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1576
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2896
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1912
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2096
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4788
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:3420
-
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:3564
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1144
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled2⤵
- Launches sc.exe
PID:3904
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:752
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:1696
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:3324
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵
- Suspicious use of WriteProcessMemory
PID:3052
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵
- Suspicious use of WriteProcessMemory
PID:2252
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:4460
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵
- Views/modifies file attributes
PID:2920
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:24:21 PM C:\Windows\Sysinf.bat2⤵PID:3780
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:21:21 PM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4296
-
-
C:\Windows\SysWOW64\At.exeAt.exe 8:22:19 PM C:\Windows\Help\HelpCat.exe2⤵PID:5072
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:4200
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:3712
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵PID:4484
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:4860
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:3800
-
-
C:\Users\Admin\AppData\Local\Temp\7ce44a252c2d7ce227044036eea3c1a5~4.exe7ce44a252c2d7ce227044036eea3c1a5~4.exe2⤵PID:1848
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:4056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:2224
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:1948
-
C:\Windows\SysWOW64\at.exeat 8:24:21 PM C:\Windows\Sysinf.bat1⤵PID:2948
-
C:\Windows\SysWOW64\at.exeat 8:21:21 PM C:\Windows\Sysinf.bat1⤵PID:4912
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:1016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:3368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:3572
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:3676
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:2096
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:4324
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:3484
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:5028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:4028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:2412
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:4844
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:5008
-
C:\Windows\SysWOW64\at.exeat 8:24:24 PM C:\Windows\Sysinf.bat1⤵
- Suspicious use of WriteProcessMemory
PID:3720
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:1940
-
C:\Windows\SysWOW64\at.exeat 8:21:24 PM C:\Windows\Sysinf.bat1⤵PID:4192
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:3372
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:632
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3564
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3676
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3796
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4948
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:752
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1016
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4200
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:988
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1028
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3096
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2940
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2112
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:752
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4584
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2120
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD575bb0b1cd7f505db8d50642814e392ca
SHA1ff89f1b3ff721f5f49db2385e5b3e73520e9653c
SHA256c2fc526636655d10f4bb3d5e0fe09c6dfcaae53e007fb7c2941ef48a41a4a9cd
SHA512f351241edb58fff3668bc3a4baf0523a8b23b080f671f935f7165333ba29358383583217aa8c04547d7ac1435b5ce99cd35613a8ff1bee07096524d7b76b8469
-
Filesize
82B
MD53f7fbd2eb34892646e93fd5e6e343512
SHA1265ac1061b54f62350fb7a5f57e566454d013a66
SHA256e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7
SHA51253d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140
-
Filesize
460B
MD57db3d565d6ddbe65a8b0e093910e7dcd
SHA1d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA256a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
SHA5120b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b
-
Filesize
2.7MB
MD544e32a63044bcd922f02e94fcb71b758
SHA18d2ccf780ada9e30324c979fb3c7b0c2445b14f8
SHA2562eef962bc639de07d049da8518a0c2cdf1930acba6191bbcc49964fbf8c7ca17
SHA5128d185ec404f50375dd21cb276b9743c8d129e1e4c5361dfd4515c13e9bb0bb051435ee019a013001794ae451c68b163ec15098a5403d2990c3bf23ad870da3de
-
Filesize
1.4MB
MD56cf9f7575d2132a3c6b9ff995ab42dc3
SHA118a73bc7a1d7b9e85b5c4ec385e5377a70d9bbe2
SHA2566a0ae9e3d4edb345cdc1e0a58af6b4bf0890150f8d9d37a36ac4e6c64f2d7f80
SHA5122f7a1ff80cb3b69018c77cd7edd1328a83e07678ad5723b3ff10d37eb431238c98fb6bd4c111175d4cc562beafe9843da296398e738d7a6df7ea65de2447b7b1
-
Filesize
2KB
MD5e7d7ec66bd61fac3843c98650b0c68f6
SHA1a15ae06e1be51038863650746368a71024539bac
SHA2566475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
SHA512ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6
-
Filesize
1.4MB
MD5af4b493477c1d3805ea96a4070412304
SHA1a561f0a7af4c7d7b3cc36747a3bffba68927af42
SHA256b2e823df38904e1e650f63ed82316180cdca4757eb7a99c55048195fd2d04927
SHA512993b8a343b6546b0e3c3d67c447bd26eec3358c1bc40f08fa7ed8dae60a08667f9295a555e4c6cd984851ee7d8802d4c0a7cce328bfe9d2c4987530ad63b5e1e