62a7ff5232fe9c43c1aaa62c467c797c9065c8702e1b41b60839bfc9de7afab9

Analysis

max time kernel
72s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f5eabf072d694ea17146bfdccdbc212.exe
Size

62KB
MD5

7f5eabf072d694ea17146bfdccdbc212
SHA1

e50407cdd376feb22bf784ddf1aac3ef5d00debe
SHA256

62a7ff5232fe9c43c1aaa62c467c797c9065c8702e1b41b60839bfc9de7afab9
SHA512

3c79e5531ee6b0f88e9a61a7c00b8268b56ab017fa078d3aab1ba6bc6020d57b18078a6445252ce56154bd78eab36b40aaac8b505b94147583cb395f5bdbe1c7
SSDEEP

1536:eBmMyMWO0SECuNbWvfqxMgP814cs0J6O:XOZHgk/VB

Score

1^/10

Malware Config

Signatures

Enumerates processes with tasklist 1 TTPs 63 IoCs

Process Discovery

T1057

pid	Process
904	tasklist.exe
1772	tasklist.exe
1968	tasklist.exe
1576	tasklist.exe
1416	tasklist.exe
1748	tasklist.exe
1236	tasklist.exe
1524	tasklist.exe
1472	tasklist.exe
980	tasklist.exe
2624	tasklist.exe
2548	tasklist.exe
1744	tasklist.exe
2816	tasklist.exe
1988	tasklist.exe
2800	tasklist.exe
1096	tasklist.exe
888	tasklist.exe
2116	tasklist.exe
2264	tasklist.exe
2912	tasklist.exe
1816	tasklist.exe
2848	tasklist.exe
2248	tasklist.exe
3064	tasklist.exe
2200	tasklist.exe
1460	tasklist.exe
2956	tasklist.exe
1076	tasklist.exe
2160	tasklist.exe
764	tasklist.exe
2096	tasklist.exe
2612	tasklist.exe
2956	tasklist.exe
2616	tasklist.exe
2368	tasklist.exe
784	tasklist.exe
2580	tasklist.exe
1056	tasklist.exe
2728	tasklist.exe
2764	tasklist.exe
1268	tasklist.exe
2272	tasklist.exe
900	tasklist.exe
2592	tasklist.exe
320	tasklist.exe
2792	tasklist.exe
820	tasklist.exe
2364	tasklist.exe
2852	tasklist.exe
2124	tasklist.exe
1080	tasklist.exe
2320	tasklist.exe
1636	tasklist.exe
2812	tasklist.exe
948	tasklist.exe
2832	tasklist.exe
1884	tasklist.exe
1068	tasklist.exe
3060	tasklist.exe
2380	tasklist.exe
2584	tasklist.exe
2488	tasklist.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
2872	PING.EXE
1088	PING.EXE
808	PING.EXE
1196	PING.EXE
644	PING.EXE
1060	PING.EXE
2516	PING.EXE
2388	PING.EXE
2312	PING.EXE
2176	PING.EXE
680	PING.EXE
944	PING.EXE
2488	PING.EXE
2564	PING.EXE
584	PING.EXE
2268	PING.EXE
2740	PING.EXE
884	PING.EXE
1596	PING.EXE
3008	PING.EXE
1672	PING.EXE
2560	PING.EXE
1712	PING.EXE
2536	PING.EXE
2776	PING.EXE
1576	PING.EXE
2628	PING.EXE
980	PING.EXE
2052	PING.EXE
2660	PING.EXE
1140	PING.EXE
2060	PING.EXE
904	PING.EXE
564	PING.EXE
1452	PING.EXE
2820	PING.EXE
2992	PING.EXE
2308	PING.EXE
312	PING.EXE
1508	PING.EXE
1888	PING.EXE
296	PING.EXE
2380	PING.EXE
2912	PING.EXE
1084	PING.EXE
2648	PING.EXE
1072	PING.EXE
1948	PING.EXE
1384	PING.EXE
2608	PING.EXE
1716	PING.EXE
1696	PING.EXE
2060	PING.EXE
1816	PING.EXE
1192	PING.EXE
1912	PING.EXE
2364	PING.EXE
2852	PING.EXE
268	PING.EXE
2056	PING.EXE
2340	PING.EXE
836	PING.EXE
1992	PING.EXE
2080	PING.EXE

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	2580	tasklist.exe
Token: SeDebugPrivilege	2264	tasklist.exe
Token: SeDebugPrivilege	2956	tasklist.exe
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeDebugPrivilege	1080	tasklist.exe
Token: SeDebugPrivilege	1748	tasklist.exe
Token: SeDebugPrivilege	980	tasklist.exe
Token: SeDebugPrivilege	2912	tasklist.exe
Token: SeDebugPrivilege	820	tasklist.exe
Token: SeDebugPrivilege	2320	tasklist.exe
Token: SeDebugPrivilege	2368	tasklist.exe
Token: SeDebugPrivilege	1816	tasklist.exe
Token: SeDebugPrivilege	1056	tasklist.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeDebugPrivilege	2364	tasklist.exe
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	1236	tasklist.exe
Token: SeDebugPrivilege	2200	tasklist.exe
Token: SeDebugPrivilege	2728	tasklist.exe
Token: SeDebugPrivilege	2852	tasklist.exe
Token: SeDebugPrivilege	2624	tasklist.exe
Token: SeDebugPrivilege	2124	tasklist.exe
Token: SeDebugPrivilege	1988	tasklist.exe
Token: SeDebugPrivilege	2272	tasklist.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	2812	tasklist.exe
Token: SeDebugPrivilege	784	tasklist.exe
Token: SeDebugPrivilege	904	tasklist.exe
Token: SeDebugPrivilege	1772	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2316	2228	7f5eabf072d694ea17146bfdccdbc212.exe	29
PID 2228 wrote to memory of 2316	2228	7f5eabf072d694ea17146bfdccdbc212.exe	29
PID 2228 wrote to memory of 2316	2228	7f5eabf072d694ea17146bfdccdbc212.exe	29
PID 2228 wrote to memory of 2316	2228	7f5eabf072d694ea17146bfdccdbc212.exe	29
PID 2316 wrote to memory of 2388	2316	cmd.exe	30
PID 2316 wrote to memory of 2388	2316	cmd.exe	30
PID 2316 wrote to memory of 2388	2316	cmd.exe	30
PID 2316 wrote to memory of 2388	2316	cmd.exe	30
PID 2316 wrote to memory of 2792	2316	cmd.exe	31
PID 2316 wrote to memory of 2792	2316	cmd.exe	31
PID 2316 wrote to memory of 2792	2316	cmd.exe	31
PID 2316 wrote to memory of 2792	2316	cmd.exe	31
PID 2316 wrote to memory of 2836	2316	cmd.exe	32
PID 2316 wrote to memory of 2836	2316	cmd.exe	32
PID 2316 wrote to memory of 2836	2316	cmd.exe	32
PID 2316 wrote to memory of 2836	2316	cmd.exe	32
PID 2316 wrote to memory of 2820	2316	cmd.exe	34
PID 2316 wrote to memory of 2820	2316	cmd.exe	34
PID 2316 wrote to memory of 2820	2316	cmd.exe	34
PID 2316 wrote to memory of 2820	2316	cmd.exe	34
PID 2316 wrote to memory of 2612	2316	cmd.exe	35
PID 2316 wrote to memory of 2612	2316	cmd.exe	35
PID 2316 wrote to memory of 2612	2316	cmd.exe	35
PID 2316 wrote to memory of 2612	2316	cmd.exe	35
PID 2316 wrote to memory of 2604	2316	cmd.exe	36
PID 2316 wrote to memory of 2604	2316	cmd.exe	36
PID 2316 wrote to memory of 2604	2316	cmd.exe	36
PID 2316 wrote to memory of 2604	2316	cmd.exe	36
PID 2316 wrote to memory of 2740	2316	cmd.exe	37
PID 2316 wrote to memory of 2740	2316	cmd.exe	37
PID 2316 wrote to memory of 2740	2316	cmd.exe	37
PID 2316 wrote to memory of 2740	2316	cmd.exe	37
PID 2316 wrote to memory of 2580	2316	cmd.exe	38
PID 2316 wrote to memory of 2580	2316	cmd.exe	38
PID 2316 wrote to memory of 2580	2316	cmd.exe	38
PID 2316 wrote to memory of 2580	2316	cmd.exe	38
PID 2316 wrote to memory of 2588	2316	cmd.exe	39
PID 2316 wrote to memory of 2588	2316	cmd.exe	39
PID 2316 wrote to memory of 2588	2316	cmd.exe	39
PID 2316 wrote to memory of 2588	2316	cmd.exe	39
PID 2316 wrote to memory of 2648	2316	cmd.exe	40
PID 2316 wrote to memory of 2648	2316	cmd.exe	40
PID 2316 wrote to memory of 2648	2316	cmd.exe	40
PID 2316 wrote to memory of 2648	2316	cmd.exe	40
PID 2316 wrote to memory of 2264	2316	cmd.exe	41
PID 2316 wrote to memory of 2264	2316	cmd.exe	41
PID 2316 wrote to memory of 2264	2316	cmd.exe	41
PID 2316 wrote to memory of 2264	2316	cmd.exe	41
PID 2316 wrote to memory of 2088	2316	cmd.exe	42
PID 2316 wrote to memory of 2088	2316	cmd.exe	42
PID 2316 wrote to memory of 2088	2316	cmd.exe	42
PID 2316 wrote to memory of 2088	2316	cmd.exe	42
PID 2316 wrote to memory of 1072	2316	cmd.exe	43
PID 2316 wrote to memory of 1072	2316	cmd.exe	43
PID 2316 wrote to memory of 1072	2316	cmd.exe	43
PID 2316 wrote to memory of 1072	2316	cmd.exe	43
PID 2316 wrote to memory of 2956	2316	cmd.exe	44
PID 2316 wrote to memory of 2956	2316	cmd.exe	44
PID 2316 wrote to memory of 2956	2316	cmd.exe	44
PID 2316 wrote to memory of 2956	2316	cmd.exe	44
PID 2316 wrote to memory of 2988	2316	cmd.exe	45
PID 2316 wrote to memory of 2988	2316	cmd.exe	45
PID 2316 wrote to memory of 2988	2316	cmd.exe	45
PID 2316 wrote to memory of 2988	2316	cmd.exe	45

C:\Users\Admin\AppData\Local\Temp\7f5eabf072d694ea17146bfdccdbc212.exe
"C:\Users\Admin\AppData\Local\Temp\7f5eabf072d694ea17146bfdccdbc212.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\4692.tmp\qc.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2388
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2820
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2740
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1072
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2060
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:528
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2872
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1088
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:680
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:916
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:904
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:808
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:820
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1948
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2340
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:836
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2380
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1384
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1576
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:944
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1712
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:884
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1596
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1696
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2992
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2608
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2308
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3008
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:564
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2628
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1452
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:784
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:680
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:980
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:904
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2912
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:668
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:312
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3060
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1508
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1460
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1672
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2764
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1816
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2380
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1192
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:948
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1992
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:900
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:644
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1096
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2312
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:888
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1060
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2160
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1716
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2584
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2488
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2052
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2848
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2832
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2560
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2116
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1888
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2956
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2060
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1076
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2564
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1884
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1084
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1744
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2660
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2816
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:268
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1268
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:584
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:544
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1140
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:764
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2248
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2080
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2548
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2536
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:320
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:296
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1524
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1196
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1068
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1912
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:956
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1576
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2364
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1416
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2056
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2096
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2516
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1472
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2176
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1968
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2776
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2852
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2488
- - C:\Windows\SysWOW64\find.exe
    find /i "rundll32.exe"
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\PING.EXE
    ping /n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2268
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4692.tmp\qc.bat

Filesize
516B

MD5
233da762785ed2e7b2baf34da407b8db

SHA1
090c257e7e5dc38cb9acf11f88e88c5e047643d5

SHA256
69bd3ea0b73004ce4e5cf94ced77c1cee6418ec70516050340222b6c93134e27

SHA512
10a0c87759dfe4df764e334ce44d517c25aa1567d64ceb653f95b31a7b98e75afdbd4248b19649cb2e06b381fec162e26b0f08ab009c74659e577c318dfe2573

Download Submit
memory/2228-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2228-9-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download