716661c0d7d8b36ad62aed15e72ded8f8ae0e63d826f38cf726b78042171adfd

Analysis

max time kernel
3s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42ef38db8329651c2c7bc7173be278ff.exe
Size

1.3MB
MD5

42ef38db8329651c2c7bc7173be278ff
SHA1

0ca514d66b782d7d6d3020689c8a8153bb59117d
SHA256

716661c0d7d8b36ad62aed15e72ded8f8ae0e63d826f38cf726b78042171adfd
SHA512

f858e7613ae163c58c7c1b12e47d94d949eb88358199b7b150f783cc7bf707c951b51e1d87c6a267b5068149e5a38700516516f5123c2dd86a5ef623be56ea58
SSDEEP

12288:UZWtI6Rkg+erQZb+md4w1UAMitTiMr5ZlUCe+moBQbVKrDgJQPs/og4:Uuhag+erQZb+md4wmAMGuSsCPBSt0OL4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	42ef38db8329651c2c7bc7173be278ff.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system\KavUpda.exe	42ef38db8329651c2c7bc7173be278ff.exe
File opened for modification	C:\Windows\system\KavUpda.exe	42ef38db8329651c2c7bc7173be278ff.exe
File created	C:\Windows\Help\HelpCat.exe	42ef38db8329651c2c7bc7173be278ff.exe
File opened for modification	C:\Windows\Help\HelpCat.exe	42ef38db8329651c2c7bc7173be278ff.exe
File created	C:\Windows\Sysinf.bat	42ef38db8329651c2c7bc7173be278ff.exe
File created	C:\Windows\regedt32.sys	42ef38db8329651c2c7bc7173be278ff.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
268	sc.exe
2204	sc.exe
1972	sc.exe
2404	sc.exe
368	sc.exe
388	sc.exe
1376	sc.exe
1928	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
580	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	42ef38db8329651c2c7bc7173be278ff.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2616	2060	42ef38db8329651c2c7bc7173be278ff.exe	22
PID 2060 wrote to memory of 2616	2060	42ef38db8329651c2c7bc7173be278ff.exe	22
PID 2060 wrote to memory of 2616	2060	42ef38db8329651c2c7bc7173be278ff.exe	22
PID 2060 wrote to memory of 2616	2060	42ef38db8329651c2c7bc7173be278ff.exe	22
PID 2060 wrote to memory of 2672	2060	42ef38db8329651c2c7bc7173be278ff.exe	131
PID 2060 wrote to memory of 2672	2060	42ef38db8329651c2c7bc7173be278ff.exe	131
PID 2060 wrote to memory of 2672	2060	42ef38db8329651c2c7bc7173be278ff.exe	131
PID 2060 wrote to memory of 2672	2060	42ef38db8329651c2c7bc7173be278ff.exe	131
PID 2672 wrote to memory of 2788	2672	attrib.exe	20
PID 2672 wrote to memory of 2788	2672	attrib.exe	20
PID 2672 wrote to memory of 2788	2672	attrib.exe	20
PID 2672 wrote to memory of 2788	2672	attrib.exe	20
PID 2060 wrote to memory of 2808	2060	42ef38db8329651c2c7bc7173be278ff.exe	33
PID 2060 wrote to memory of 2808	2060	42ef38db8329651c2c7bc7173be278ff.exe	33
PID 2060 wrote to memory of 2808	2060	42ef38db8329651c2c7bc7173be278ff.exe	33
PID 2060 wrote to memory of 2808	2060	42ef38db8329651c2c7bc7173be278ff.exe	33
PID 2060 wrote to memory of 2640	2060	42ef38db8329651c2c7bc7173be278ff.exe	73
PID 2060 wrote to memory of 2640	2060	42ef38db8329651c2c7bc7173be278ff.exe	73
PID 2060 wrote to memory of 2640	2060	42ef38db8329651c2c7bc7173be278ff.exe	73
PID 2060 wrote to memory of 2640	2060	42ef38db8329651c2c7bc7173be278ff.exe	73
PID 2060 wrote to memory of 2004	2060	42ef38db8329651c2c7bc7173be278ff.exe	72
PID 2060 wrote to memory of 2004	2060	42ef38db8329651c2c7bc7173be278ff.exe	72
PID 2060 wrote to memory of 2004	2060	42ef38db8329651c2c7bc7173be278ff.exe	72
PID 2060 wrote to memory of 2004	2060	42ef38db8329651c2c7bc7173be278ff.exe	72
PID 2060 wrote to memory of 2552	2060	42ef38db8329651c2c7bc7173be278ff.exe	138
PID 2060 wrote to memory of 2552	2060	42ef38db8329651c2c7bc7173be278ff.exe	138
PID 2060 wrote to memory of 2552	2060	42ef38db8329651c2c7bc7173be278ff.exe	138
PID 2060 wrote to memory of 2552	2060	42ef38db8329651c2c7bc7173be278ff.exe	138
PID 2060 wrote to memory of 2660	2060	42ef38db8329651c2c7bc7173be278ff.exe	69
PID 2060 wrote to memory of 2660	2060	42ef38db8329651c2c7bc7173be278ff.exe	69
PID 2060 wrote to memory of 2660	2060	42ef38db8329651c2c7bc7173be278ff.exe	69
PID 2060 wrote to memory of 2660	2060	42ef38db8329651c2c7bc7173be278ff.exe	69
PID 2640 wrote to memory of 2636	2640	cmd.exe	67
PID 2640 wrote to memory of 2636	2640	cmd.exe	67
PID 2640 wrote to memory of 2636	2640	cmd.exe	67
PID 2640 wrote to memory of 2636	2640	cmd.exe	67
PID 2060 wrote to memory of 2520	2060	42ef38db8329651c2c7bc7173be278ff.exe	65
PID 2060 wrote to memory of 2520	2060	42ef38db8329651c2c7bc7173be278ff.exe	65
PID 2060 wrote to memory of 2520	2060	42ef38db8329651c2c7bc7173be278ff.exe	65
PID 2060 wrote to memory of 2520	2060	42ef38db8329651c2c7bc7173be278ff.exe	65
PID 2060 wrote to memory of 2208	2060	42ef38db8329651c2c7bc7173be278ff.exe	64
PID 2060 wrote to memory of 2208	2060	42ef38db8329651c2c7bc7173be278ff.exe	64
PID 2060 wrote to memory of 2208	2060	42ef38db8329651c2c7bc7173be278ff.exe	64
PID 2060 wrote to memory of 2208	2060	42ef38db8329651c2c7bc7173be278ff.exe	64
PID 2060 wrote to memory of 2500	2060	42ef38db8329651c2c7bc7173be278ff.exe	62
PID 2060 wrote to memory of 2500	2060	42ef38db8329651c2c7bc7173be278ff.exe	62
PID 2060 wrote to memory of 2500	2060	42ef38db8329651c2c7bc7173be278ff.exe	62
PID 2060 wrote to memory of 2500	2060	42ef38db8329651c2c7bc7173be278ff.exe	62
PID 2060 wrote to memory of 2404	2060	42ef38db8329651c2c7bc7173be278ff.exe	61
PID 2060 wrote to memory of 2404	2060	42ef38db8329651c2c7bc7173be278ff.exe	61
PID 2060 wrote to memory of 2404	2060	42ef38db8329651c2c7bc7173be278ff.exe	61
PID 2060 wrote to memory of 2404	2060	42ef38db8329651c2c7bc7173be278ff.exe	61
PID 2060 wrote to memory of 1972	2060	42ef38db8329651c2c7bc7173be278ff.exe	144
PID 2060 wrote to memory of 1972	2060	42ef38db8329651c2c7bc7173be278ff.exe	144
PID 2060 wrote to memory of 1972	2060	42ef38db8329651c2c7bc7173be278ff.exe	144
PID 2060 wrote to memory of 1972	2060	42ef38db8329651c2c7bc7173be278ff.exe	144
PID 2060 wrote to memory of 2204	2060	42ef38db8329651c2c7bc7173be278ff.exe	57
PID 2060 wrote to memory of 2204	2060	42ef38db8329651c2c7bc7173be278ff.exe	57
PID 2060 wrote to memory of 2204	2060	42ef38db8329651c2c7bc7173be278ff.exe	57
PID 2060 wrote to memory of 2204	2060	42ef38db8329651c2c7bc7173be278ff.exe	57
PID 2552 wrote to memory of 588	2552	cmd.exe	56
PID 2552 wrote to memory of 588	2552	cmd.exe	56
PID 2552 wrote to memory of 588	2552	cmd.exe	56
PID 2552 wrote to memory of 588	2552	cmd.exe	56

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2544	attrib.exe
1660	attrib.exe
1736	attrib.exe
1724	attrib.exe
572	attrib.exe
2272	attrib.exe
2600	attrib.exe
828	attrib.exe
1564	attrib.exe
1532	attrib.exe
2672	attrib.exe
2940	attrib.exe
1640	attrib.exe
1320	attrib.exe
2044	attrib.exe
2532	attrib.exe

C:\Users\Admin\AppData\Local\Temp\42ef38db8329651c2c7bc7173be278ff.exe
"C:\Users\Admin\AppData\Local\Temp\42ef38db8329651c2c7bc7173be278ff.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start schedule /y
    3⤵
    PID:2788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Option.bat
  2⤵
  PID:2616
- C:\Windows\SysWOW64\At.exe
  At.exe 2:54:29 AM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:2808
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc /y
    3⤵
    PID:588
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:2612
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:2900
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  PID:2952
- - C:\Windows\SysWOW64\At.exe
    At.exe 2:54:33 AM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:2356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc /y
      4⤵
      PID:2336
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:2416
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv /y
      4⤵
      PID:2924
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:368
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:388
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1376
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:1928
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 2:56:35 AM C:\Windows\Sysinf.bat
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 2:53:35 AM C:\Windows\Sysinf.bat
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:572
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:696
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1656
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Runs regedit.exe
  PID:580
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:268
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2204
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:1972
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2404
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:2500
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:2208
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2520
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 2:56:31 AM C:\Windows\Sysinf.bat
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 2:53:31 AM C:\Windows\Sysinf.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1092
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:2328
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2980
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:868
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:1640

C:\Windows\SysWOW64\at.exe
at 2:56:31 AM C:\Windows\Sysinf.bat
1⤵
PID:1344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:2828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:572

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
1⤵
PID:2440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:584

C:\Windows\SysWOW64\at.exe
at 2:53:31 AM C:\Windows\Sysinf.bat
1⤵
PID:2636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:1100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:1764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:2164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:3016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:2252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:892

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1532

C:\Windows\SysWOW64\at.exe
at 2:56:35 AM C:\Windows\Sysinf.bat
1⤵
PID:1000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:2320

C:\Windows\SysWOW64\at.exe
at 2:53:35 AM C:\Windows\Sysinf.bat
1⤵
PID:2368

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Suspicious use of WriteProcessMemory
- Views/modifies file attributes
PID:2672

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2544

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "71781251460681660187266497-909759978-11019886731352873518-997389086-895354190"
1⤵
PID:584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1459711789-1603937587752576605538513912-717640225298216246-76245714696140692"
1⤵
PID:1972

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2272

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1660

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1736

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1640

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1320

C:\Windows\system32\taskeng.exe
taskeng.exe {CAB8DF6C-D2FD-4CD1-B03B-120CBC9963C3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2280

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2044

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2600

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2532

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:828

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download