4a2a075054fce84d57c1f11ef8409c8e545df35352173473237735ab9cb6102e

Analysis

max time kernel
2s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e5f37e13f485c7400ea8b2865ee6ff.exe
Size

2.2MB
MD5

04e5f37e13f485c7400ea8b2865ee6ff
SHA1

46cd08635380ec45b379f5fbee7c9c01d5201577
SHA256

4a2a075054fce84d57c1f11ef8409c8e545df35352173473237735ab9cb6102e
SHA512

cde0578e247b1fbbf536034e5930943dbea745be6456c6719bffb0a399065f516493f7e3790ec8ba9a9291ae8b96df50a3227e0d51b246eef14d88b02ecb8d1c
SSDEEP

12288:UZWtI6RkKOB0v2eZJys73dOvXDpNjNe8NuMpX4aBaa4sDEpUE9QDV9U11S/3zKu8:UuhaKOA2eZJ8NI8NahxAOu2dA1S43Zu

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	04e5f37e13f485c7400ea8b2865ee6ff.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\HelpCat.exe	04e5f37e13f485c7400ea8b2865ee6ff.exe
File created	C:\Windows\Sysinf.bat	04e5f37e13f485c7400ea8b2865ee6ff.exe
File created	C:\Windows\system\KavUpda.exe	04e5f37e13f485c7400ea8b2865ee6ff.exe
File opened for modification	C:\Windows\system\KavUpda.exe	04e5f37e13f485c7400ea8b2865ee6ff.exe
File created	C:\Windows\Help\HelpCat.exe	04e5f37e13f485c7400ea8b2865ee6ff.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2200	sc.exe
924	sc.exe
1308	sc.exe
1632	sc.exe
1624	sc.exe
2288	sc.exe
1204	sc.exe
676	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
1748	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2296	04e5f37e13f485c7400ea8b2865ee6ff.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2672	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	20
PID 2296 wrote to memory of 2672	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	20
PID 2296 wrote to memory of 2672	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	20
PID 2296 wrote to memory of 2672	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	20
PID 2296 wrote to memory of 2792	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	18
PID 2296 wrote to memory of 2792	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	18
PID 2296 wrote to memory of 2792	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	18
PID 2296 wrote to memory of 2792	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	18
PID 2792 wrote to memory of 2716	2792	net.exe	16
PID 2792 wrote to memory of 2716	2792	net.exe	16
PID 2792 wrote to memory of 2716	2792	net.exe	16
PID 2792 wrote to memory of 2716	2792	net.exe	16
PID 2296 wrote to memory of 2592	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	74
PID 2296 wrote to memory of 2592	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	74
PID 2296 wrote to memory of 2592	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	74
PID 2296 wrote to memory of 2592	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	74
PID 2296 wrote to memory of 2884	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	73
PID 2296 wrote to memory of 2884	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	73
PID 2296 wrote to memory of 2884	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	73
PID 2296 wrote to memory of 2884	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	73
PID 2296 wrote to memory of 3028	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	71
PID 2296 wrote to memory of 3028	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	71
PID 2296 wrote to memory of 3028	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	71
PID 2296 wrote to memory of 3028	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	71
PID 2296 wrote to memory of 2832	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	69
PID 2296 wrote to memory of 2832	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	69
PID 2296 wrote to memory of 2832	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	69
PID 2296 wrote to memory of 2832	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	69
PID 2296 wrote to memory of 2564	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	67
PID 2296 wrote to memory of 2564	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	67
PID 2296 wrote to memory of 2564	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	67
PID 2296 wrote to memory of 2564	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	67
PID 2296 wrote to memory of 2596	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	66
PID 2296 wrote to memory of 2596	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	66
PID 2296 wrote to memory of 2596	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	66
PID 2296 wrote to memory of 2596	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	66
PID 2296 wrote to memory of 2636	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	64
PID 2296 wrote to memory of 2636	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	64
PID 2296 wrote to memory of 2636	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	64
PID 2296 wrote to memory of 2636	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	64
PID 2832 wrote to memory of 2980	2832	net.exe	62
PID 2832 wrote to memory of 2980	2832	net.exe	62
PID 2832 wrote to memory of 2980	2832	net.exe	62
PID 2832 wrote to memory of 2980	2832	net.exe	62
PID 2296 wrote to memory of 2840	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	60
PID 2296 wrote to memory of 2840	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	60
PID 2296 wrote to memory of 2840	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	60
PID 2296 wrote to memory of 2840	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	60
PID 3028 wrote to memory of 2408	3028	cmd.exe	59
PID 3028 wrote to memory of 2408	3028	cmd.exe	59
PID 3028 wrote to memory of 2408	3028	cmd.exe	59
PID 3028 wrote to memory of 2408	3028	cmd.exe	59
PID 2884 wrote to memory of 2608	2884	cmd.exe	65
PID 2884 wrote to memory of 2608	2884	cmd.exe	65
PID 2884 wrote to memory of 2608	2884	cmd.exe	65
PID 2884 wrote to memory of 2608	2884	cmd.exe	65
PID 2296 wrote to memory of 676	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	57
PID 2296 wrote to memory of 676	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	57
PID 2296 wrote to memory of 676	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	57
PID 2296 wrote to memory of 676	2296	04e5f37e13f485c7400ea8b2865ee6ff.exe	57
PID 2636 wrote to memory of 1364	2636	net.exe	56
PID 2636 wrote to memory of 1364	2636	net.exe	56
PID 2636 wrote to memory of 1364	2636	net.exe	56
PID 2636 wrote to memory of 1364	2636	net.exe	56

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2524	attrib.exe
288	attrib.exe
2824	attrib.exe
532	attrib.exe
2788	attrib.exe
2900	attrib.exe
2884	attrib.exe
2432	attrib.exe
1308	attrib.exe
2940	attrib.exe
2028	attrib.exe
2728	attrib.exe
2592	attrib.exe
1604	attrib.exe
1736	attrib.exe
1540	attrib.exe

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
1⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\04e5f37e13f485c7400ea8b2865ee6ff.exe
"C:\Users\Admin\AppData\Local\Temp\04e5f37e13f485c7400ea8b2865ee6ff.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:2024
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:2008
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Runs regedit.exe
  PID:1748
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:1624
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:924
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:1308
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:1632
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:532
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:288
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:688
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 7:45:55 AM C:\Windows\Sysinf.bat
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 7:42:55 AM C:\Windows\Sysinf.bat
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\At.exe
    At.exe 7:43:53 AM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1208
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:572
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:652
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2288
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:1204
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:676
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:2840
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2596
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:2564
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 7:45:52 AM C:\Windows\Sysinf.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 7:42:52 AM C:\Windows\Sysinf.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- C:\Windows\SysWOW64\At.exe
  At.exe 7:43:50 AM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:2592
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sharedaccess /y
    3⤵
    PID:2232
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop srservice /y
    3⤵
    PID:900
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1876
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:1408
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:1948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:2136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:2508

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
PID:1692

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
1⤵
PID:708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:2844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:1708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:1364

C:\Windows\SysWOW64\at.exe
at 7:45:52 AM C:\Windows\Sysinf.bat
1⤵
PID:2408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:2980

C:\Windows\SysWOW64\at.exe
at 7:42:52 AM C:\Windows\Sysinf.bat
1⤵
PID:2608

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:328

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:1612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:1568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:2464

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1732

C:\Windows\SysWOW64\at.exe
at 7:45:55 AM C:\Windows\Sysinf.bat
1⤵
PID:2956

C:\Windows\SysWOW64\at.exe
at 7:42:55 AM C:\Windows\Sysinf.bat
1⤵
PID:2928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:576

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2900

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2028

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2728

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2824

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2432

C:\Windows\system32\taskeng.exe
taskeng.exe {EB834586-D188-42AE-9239-FD7C43A66310} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1040

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1736

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:532

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1429348085-15622278421328082406-15422112331858419193-20458809551176025644820586361"
1⤵
PID:1204

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download