0ecd4b962d0dbf8442eba8d4c0c69123e0f35272c81b3943ceef08ff030b3533

Analysis

max time kernel
2s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11ed9582b65d1ab98f0f8091e3bc9057.exe
Size

3.7MB
MD5

11ed9582b65d1ab98f0f8091e3bc9057
SHA1

3db8eac671122b991760f8ded268c620a44b657c
SHA256

0ecd4b962d0dbf8442eba8d4c0c69123e0f35272c81b3943ceef08ff030b3533
SHA512

314a21846ec426c2e59077795d0b8fddf1365ab83b957901e5ca7236c20a4bd840bc9a31a3c93d5fe110f983d835736843f5d6adb7b7b32bedaa8842371d3b48
SSDEEP

49152:be8u8l8u8G8u8l8u8G8u8l8u8G8u8l8u8G8u8l8u8D:+

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Conhost.exe

Blocks application from running via registry modification 17 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe"	Conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe"	Conhost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe"	Conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE"	Conhost.exe

Sets file execution options in registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe"	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Conhost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	11ed9582b65d1ab98f0f8091e3bc9057.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Help\HelpCat.exe	11ed9582b65d1ab98f0f8091e3bc9057.exe
File opened for modification	C:\Windows\Help\HelpCat.exe	11ed9582b65d1ab98f0f8091e3bc9057.exe
File created	C:\Windows\Sysinf.bat	11ed9582b65d1ab98f0f8091e3bc9057.exe
File created	C:\Windows\regedt32.sys	11ed9582b65d1ab98f0f8091e3bc9057.exe
File created	C:\Windows\system\KavUpda.exe	11ed9582b65d1ab98f0f8091e3bc9057.exe
File opened for modification	C:\Windows\system\KavUpda.exe	11ed9582b65d1ab98f0f8091e3bc9057.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1684	sc.exe
4212	sc.exe
3664	sc.exe
4720	sc.exe
2864	sc.exe
4200	sc.exe
2452	sc.exe
2396	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
4604	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	11ed9582b65d1ab98f0f8091e3bc9057.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1680	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	27
PID 4580 wrote to memory of 1680	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	27
PID 4580 wrote to memory of 1680	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	27
PID 4580 wrote to memory of 3284	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	26
PID 4580 wrote to memory of 3284	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	26
PID 4580 wrote to memory of 3284	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	26
PID 3284 wrote to memory of 3540	3284	net.exe	24
PID 3284 wrote to memory of 3540	3284	net.exe	24
PID 3284 wrote to memory of 3540	3284	net.exe	24
PID 4580 wrote to memory of 4536	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	146
PID 4580 wrote to memory of 4536	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	146
PID 4580 wrote to memory of 4536	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	146
PID 4580 wrote to memory of 3564	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	229
PID 4580 wrote to memory of 3564	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	229
PID 4580 wrote to memory of 3564	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	229
PID 4580 wrote to memory of 2640	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	109
PID 4580 wrote to memory of 2640	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	109
PID 4580 wrote to memory of 2640	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	109
PID 4580 wrote to memory of 3064	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	100
PID 4580 wrote to memory of 3064	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	100
PID 4580 wrote to memory of 3064	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	100
PID 4580 wrote to memory of 4372	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	99
PID 4580 wrote to memory of 4372	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	99
PID 4580 wrote to memory of 4372	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	99
PID 4580 wrote to memory of 4760	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	135
PID 4580 wrote to memory of 4760	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	135
PID 4580 wrote to memory of 4760	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	135
PID 4580 wrote to memory of 3668	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	94
PID 4580 wrote to memory of 3668	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	94
PID 4580 wrote to memory of 3668	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	94
PID 4580 wrote to memory of 968	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	91
PID 4580 wrote to memory of 968	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	91
PID 4580 wrote to memory of 968	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	91
PID 4580 wrote to memory of 3664	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	89
PID 4580 wrote to memory of 3664	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	89
PID 4580 wrote to memory of 3664	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	89
PID 4580 wrote to memory of 4212	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	87
PID 4580 wrote to memory of 4212	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	87
PID 4580 wrote to memory of 4212	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	87
PID 4580 wrote to memory of 1684	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	86
PID 4580 wrote to memory of 1684	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	86
PID 4580 wrote to memory of 1684	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	86
PID 4580 wrote to memory of 2396	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	64
PID 4580 wrote to memory of 2396	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	64
PID 4580 wrote to memory of 2396	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	64
PID 4580 wrote to memory of 4604	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	143
PID 4580 wrote to memory of 4604	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	143
PID 4580 wrote to memory of 4604	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	143
PID 4580 wrote to memory of 2280	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	83
PID 4580 wrote to memory of 2280	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	83
PID 4580 wrote to memory of 2280	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	83
PID 4580 wrote to memory of 3740	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	82
PID 4580 wrote to memory of 3740	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	82
PID 4580 wrote to memory of 3740	4580	11ed9582b65d1ab98f0f8091e3bc9057.exe	82
PID 4372 wrote to memory of 2804	4372	net.exe	80
PID 4372 wrote to memory of 2804	4372	net.exe	80
PID 4372 wrote to memory of 2804	4372	net.exe	80

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3100	attrib.exe
4948	attrib.exe
1056	attrib.exe
4172	attrib.exe
3684	attrib.exe
2324	attrib.exe
4936	attrib.exe
2824	attrib.exe
4656	attrib.exe
2692	attrib.exe
4688	attrib.exe
3700	attrib.exe
1048	attrib.exe
3648	attrib.exe
2728	attrib.exe
2732	attrib.exe

C:\Users\Admin\AppData\Local\Temp\11ed9582b65d1ab98f0f8091e3bc9057.exe
"C:\Users\Admin\AppData\Local\Temp\11ed9582b65d1ab98f0f8091e3bc9057.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  PID:1680
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Runs regedit.exe
  PID:4604
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2396
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  PID:468
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:4720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:4656
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:2864
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4200
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:2452
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 5:22:42 AM C:\Windows\Sysinf.bat
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 5:19:42 AM C:\Windows\Sysinf.bat
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\At.exe
    At.exe 5:20:40 AM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:5112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:5112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:3300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:3692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4268
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:3740
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:2280
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1684
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:4212
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:3664
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:968
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:3668
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:4760
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:3064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 5:22:38 AM C:\Windows\Sysinf.bat
  2⤵
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 5:19:38 AM C:\Windows\Sysinf.bat
  2⤵
  PID:3564
- C:\Windows\SysWOW64\At.exe
  At.exe 5:20:36 AM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:4536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop srservice /y
    3⤵
    PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2732
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1108
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:4284
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:4884
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:4540
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:2056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:3540

C:\Windows\SysWOW64\at.exe
at 5:22:38 AM C:\Windows\Sysinf.bat
1⤵
PID:60

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:1648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:2700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:3924

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
1⤵
PID:1204

C:\Windows\SysWOW64\at.exe
at 5:19:38 AM C:\Windows\Sysinf.bat
1⤵
PID:3628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:3780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:4724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:2804

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:4700

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:4068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:2252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:4424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:920

C:\Windows\SysWOW64\at.exe
at 5:19:42 AM C:\Windows\Sysinf.bat
1⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:4660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:1936

C:\Windows\SysWOW64\at.exe
at 5:22:42 AM C:\Windows\Sysinf.bat
1⤵
PID:696

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4760

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Modifies visibility of file extensions in Explorer
- Blocks application from running via registry modification
- Sets file execution options in registry
PID:4604

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2692

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4688

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3700

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:3564

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1048

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1056

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3648

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2824

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3684

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3100

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4580-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads