Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
f9bcb20fba36256268e5ea121b91f31b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f9bcb20fba36256268e5ea121b91f31b.exe
Resource
win10v2004-20231215-en
General
-
Target
f9bcb20fba36256268e5ea121b91f31b.exe
-
Size
1.9MB
-
MD5
f9bcb20fba36256268e5ea121b91f31b
-
SHA1
3af46c6904ce5424e498a2be169fc61f7dca6093
-
SHA256
7cfb1f11490e63ad8328b5f02727242be0a80cf1e4f0a41c8f62a98039fbcb1f
-
SHA512
523e1553b9e15f236c0f1a4a6683d1656d380355c7d8b83c743ff6330ff9098726174702c7b7062718f22b7a9b319913292c55c110f75d90d18b7d800e88448f
-
SSDEEP
12288:UZWtI6Rk6OB0vOB07wOgOB0vOB07wOgOB0vOB07wOgOB0vOB07wOgOB0vOB07VCh:Uuha6OWO0aOWO0aOWO0aOWO0aOWO0AJ
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Option.bat f9bcb20fba36256268e5ea121b91f31b.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Help\HelpCat.exe f9bcb20fba36256268e5ea121b91f31b.exe File created C:\Windows\Sysinf.bat f9bcb20fba36256268e5ea121b91f31b.exe File created C:\Windows\system\KavUpda.exe f9bcb20fba36256268e5ea121b91f31b.exe File opened for modification C:\Windows\system\KavUpda.exe f9bcb20fba36256268e5ea121b91f31b.exe File created C:\Windows\Help\HelpCat.exe f9bcb20fba36256268e5ea121b91f31b.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1248 sc.exe 2056 sc.exe 2752 sc.exe 3040 sc.exe 568 sc.exe 1964 sc.exe 1536 sc.exe 2052 sc.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
pid Process 1068 regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2824 f9bcb20fba36256268e5ea121b91f31b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2936 2824 f9bcb20fba36256268e5ea121b91f31b.exe 20 PID 2824 wrote to memory of 2936 2824 f9bcb20fba36256268e5ea121b91f31b.exe 20 PID 2824 wrote to memory of 2936 2824 f9bcb20fba36256268e5ea121b91f31b.exe 20 PID 2824 wrote to memory of 2936 2824 f9bcb20fba36256268e5ea121b91f31b.exe 20 PID 2824 wrote to memory of 3000 2824 f9bcb20fba36256268e5ea121b91f31b.exe 18 PID 2824 wrote to memory of 3000 2824 f9bcb20fba36256268e5ea121b91f31b.exe 18 PID 2824 wrote to memory of 3000 2824 f9bcb20fba36256268e5ea121b91f31b.exe 18 PID 2824 wrote to memory of 3000 2824 f9bcb20fba36256268e5ea121b91f31b.exe 18 PID 3000 wrote to memory of 3052 3000 net.exe 16 PID 3000 wrote to memory of 3052 3000 net.exe 16 PID 3000 wrote to memory of 3052 3000 net.exe 16 PID 3000 wrote to memory of 3052 3000 net.exe 16 PID 2824 wrote to memory of 2636 2824 f9bcb20fba36256268e5ea121b91f31b.exe 141 PID 2824 wrote to memory of 2636 2824 f9bcb20fba36256268e5ea121b91f31b.exe 141 PID 2824 wrote to memory of 2636 2824 f9bcb20fba36256268e5ea121b91f31b.exe 141 PID 2824 wrote to memory of 2636 2824 f9bcb20fba36256268e5ea121b91f31b.exe 141 PID 2824 wrote to memory of 2648 2824 f9bcb20fba36256268e5ea121b91f31b.exe 73 PID 2824 wrote to memory of 2648 2824 f9bcb20fba36256268e5ea121b91f31b.exe 73 PID 2824 wrote to memory of 2648 2824 f9bcb20fba36256268e5ea121b91f31b.exe 73 PID 2824 wrote to memory of 2648 2824 f9bcb20fba36256268e5ea121b91f31b.exe 73 PID 2824 wrote to memory of 2688 2824 f9bcb20fba36256268e5ea121b91f31b.exe 71 PID 2824 wrote to memory of 2688 2824 f9bcb20fba36256268e5ea121b91f31b.exe 71 PID 2824 wrote to memory of 2688 2824 f9bcb20fba36256268e5ea121b91f31b.exe 71 PID 2824 wrote to memory of 2688 2824 f9bcb20fba36256268e5ea121b91f31b.exe 71 PID 2824 wrote to memory of 2640 2824 f9bcb20fba36256268e5ea121b91f31b.exe 69 PID 2824 wrote to memory of 2640 2824 f9bcb20fba36256268e5ea121b91f31b.exe 69 PID 2824 wrote to memory of 2640 2824 f9bcb20fba36256268e5ea121b91f31b.exe 69 PID 2824 wrote to memory of 2640 2824 f9bcb20fba36256268e5ea121b91f31b.exe 69 PID 2824 wrote to memory of 2712 2824 f9bcb20fba36256268e5ea121b91f31b.exe 67 PID 2824 wrote to memory of 2712 2824 f9bcb20fba36256268e5ea121b91f31b.exe 67 PID 2824 wrote to memory of 2712 2824 f9bcb20fba36256268e5ea121b91f31b.exe 67 PID 2824 wrote to memory of 2712 2824 f9bcb20fba36256268e5ea121b91f31b.exe 67 PID 2824 wrote to memory of 2448 2824 f9bcb20fba36256268e5ea121b91f31b.exe 65 PID 2824 wrote to memory of 2448 2824 f9bcb20fba36256268e5ea121b91f31b.exe 65 PID 2824 wrote to memory of 2448 2824 f9bcb20fba36256268e5ea121b91f31b.exe 65 PID 2824 wrote to memory of 2448 2824 f9bcb20fba36256268e5ea121b91f31b.exe 65 PID 2640 wrote to memory of 2600 2640 net.exe 64 PID 2640 wrote to memory of 2600 2640 net.exe 64 PID 2640 wrote to memory of 2600 2640 net.exe 64 PID 2640 wrote to memory of 2600 2640 net.exe 64 PID 2824 wrote to memory of 2528 2824 f9bcb20fba36256268e5ea121b91f31b.exe 62 PID 2824 wrote to memory of 2528 2824 f9bcb20fba36256268e5ea121b91f31b.exe 62 PID 2824 wrote to memory of 2528 2824 f9bcb20fba36256268e5ea121b91f31b.exe 62 PID 2824 wrote to memory of 2528 2824 f9bcb20fba36256268e5ea121b91f31b.exe 62 PID 2648 wrote to memory of 2480 2648 cmd.exe 60 PID 2648 wrote to memory of 2480 2648 cmd.exe 60 PID 2648 wrote to memory of 2480 2648 cmd.exe 60 PID 2648 wrote to memory of 2480 2648 cmd.exe 60 PID 2688 wrote to memory of 2792 2688 cmd.exe 61 PID 2688 wrote to memory of 2792 2688 cmd.exe 61 PID 2688 wrote to memory of 2792 2688 cmd.exe 61 PID 2688 wrote to memory of 2792 2688 cmd.exe 61 PID 2448 wrote to memory of 2436 2448 net.exe 58 PID 2448 wrote to memory of 2436 2448 net.exe 58 PID 2448 wrote to memory of 2436 2448 net.exe 58 PID 2448 wrote to memory of 2436 2448 net.exe 58 PID 2712 wrote to memory of 2456 2712 net.exe 57 PID 2712 wrote to memory of 2456 2712 net.exe 57 PID 2712 wrote to memory of 2456 2712 net.exe 57 PID 2712 wrote to memory of 2456 2712 net.exe 57 PID 2824 wrote to memory of 2604 2824 f9bcb20fba36256268e5ea121b91f31b.exe 34 PID 2824 wrote to memory of 2604 2824 f9bcb20fba36256268e5ea121b91f31b.exe 34 PID 2824 wrote to memory of 2604 2824 f9bcb20fba36256268e5ea121b91f31b.exe 34 PID 2824 wrote to memory of 2604 2824 f9bcb20fba36256268e5ea121b91f31b.exe 34 -
Views/modifies file attributes 1 TTPs 16 IoCs
pid Process 2576 attrib.exe 2044 attrib.exe 2276 attrib.exe 2896 attrib.exe 2812 attrib.exe 1592 attrib.exe 2328 attrib.exe 1016 attrib.exe 2596 attrib.exe 2760 attrib.exe 2428 attrib.exe 2740 attrib.exe 2236 attrib.exe 2264 attrib.exe 2588 attrib.exe 1976 attrib.exe
Processes
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:3052
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y1⤵
- Suspicious use of WriteProcessMemory
PID:3000
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Option.bat1⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\f9bcb20fba36256268e5ea121b91f31b.exe"C:\Users\Admin\AppData\Local\Temp\f9bcb20fba36256268e5ea121b91f31b.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:2604
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y3⤵PID:1612
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled2⤵
- Launches sc.exe
PID:2052
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\regedt32.sys2⤵
- Runs regedit.exe
PID:1068
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:1184
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:1136
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:1248
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe2⤵PID:1972
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2064
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2420
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:2012
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:844
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:3040
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled3⤵
- Launches sc.exe
PID:568
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:1964
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:1536
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y3⤵PID:1764
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y3⤵PID:2756
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y3⤵PID:2276
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y3⤵PID:2380
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y3⤵PID:2668
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 9:01:14 PM C:\Windows\Sysinf.bat3⤵PID:2540
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:58:14 PM C:\Windows\Sysinf.bat3⤵PID:1824
-
-
C:\Windows\SysWOW64\At.exeAt.exe 8:59:12 PM C:\Windows\Help\HelpCat.exe3⤵PID:1340
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2896
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2972
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2184
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2016
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2024
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2916
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2040
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1792
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2416
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:776
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2084
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2268
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2284
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1952
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1188
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2772
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2080
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3008
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2996
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1004
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2724
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1640
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1096
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2440
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:696
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2664
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2068
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2784
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2056
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:2752
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:2528
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵
- Suspicious use of WriteProcessMemory
PID:2448
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵
- Suspicious use of WriteProcessMemory
PID:2712
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:2640
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 9:01:11 PM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2688
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 8:58:11 PM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2648
-
-
C:\Windows\SysWOW64\At.exeAt.exe 8:59:09 PM C:\Windows\Help\HelpCat.exe2⤵PID:2636
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:1584
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:2864
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵PID:1860
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:2808
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:2084
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵
- Views/modifies file attributes
PID:2276
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:936
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y1⤵PID:956
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Option.bat1⤵PID:764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:2788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:2456
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:2436
-
C:\Windows\SysWOW64\at.exeat 8:58:11 PM C:\Windows\Sysinf.bat1⤵PID:2480
-
C:\Windows\SysWOW64\at.exeat 9:01:11 PM C:\Windows\Sysinf.bat1⤵PID:2792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:2600
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:1872
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:1512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:2856
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:1052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:620
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:584
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:2008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:1500
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:632
-
C:\Windows\SysWOW64\at.exeat 9:01:14 PM C:\Windows\Sysinf.bat1⤵PID:668
-
C:\Windows\SysWOW64\at.exeat 8:58:14 PM C:\Windows\Sysinf.bat1⤵PID:3004
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2588
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1976
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2328
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1074001403-1251906310-710821175519430456662813193-1263477000-1558225054495212019"1⤵PID:2636
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2428
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2740
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1016
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2236
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2264
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2576
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2044
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2596
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2760
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD53f7fbd2eb34892646e93fd5e6e343512
SHA1265ac1061b54f62350fb7a5f57e566454d013a66
SHA256e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7
SHA51253d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140