Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:50 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2ab1bba297feb6086115d9f3ad81a7ab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2ab1bba297feb6086115d9f3ad81a7ab.exe
Resource
win10v2004-20231215-en
General
-
Target
2ab1bba297feb6086115d9f3ad81a7ab.exe
-
Size
1.9MB
-
MD5
2ab1bba297feb6086115d9f3ad81a7ab
-
SHA1
3c591e1fb5550f3bb298e96251f8a0e2ae44b0ce
-
SHA256
dabfdfccb61a75867d9e77cb416602e484035aae3673d6e81f18686d18b834e6
-
SHA512
b7e25fca3e22a49caee8d4f95b10ba7c4fb96d631b26e111c1a9a1b73047fba6acd00b62d8763f951fa2b043f7ecc8b345ddbe141a4b7bbcf23488a1d61f6946
-
SSDEEP
12288:UZWtI6RkAunupOB0fONunupOB0fONunupOB0fONunupOB0fONunupOB0fONunup3:UuhaCOxOxOxOxOxOEOn4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" regedit.exe -
Blocks application from running via registry modification 17 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" regedit.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" regedit.exe -
Sets file execution options in registry 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe regedit.exe -
Executes dropped EXE 2 IoCs
pid Process 1340 KavUpda.exe 1196 2ab1bba297feb6086115d9f3ad81a7ab~4.exe -
Loads dropped DLL 4 IoCs
pid Process 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Option.bat KavUpda.exe File created C:\Windows\SysWOW64\Option.bat 2ab1bba297feb6086115d9f3ad81a7ab.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Sysinf.bat 2ab1bba297feb6086115d9f3ad81a7ab.exe File created C:\Windows\regedt32.sys 2ab1bba297feb6086115d9f3ad81a7ab.exe File opened for modification C:\Windows\system\KavUpda.exe KavUpda.exe File opened for modification C:\Windows\Sysinf.bat KavUpda.exe File opened for modification C:\Windows\regedt32.sys KavUpda.exe File opened for modification C:\Windows\system\KavUpda.exe 2ab1bba297feb6086115d9f3ad81a7ab.exe File opened for modification C:\Windows\Help\HelpCat.exe 2ab1bba297feb6086115d9f3ad81a7ab.exe File created C:\Windows\regedt32.sys KavUpda.exe File created C:\Windows\Help\HelpCat.exe 2ab1bba297feb6086115d9f3ad81a7ab.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2368 sc.exe 2300 sc.exe 2376 sc.exe 1484 sc.exe 328 sc.exe 848 sc.exe 2912 sc.exe 2864 sc.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
pid Process 756 regedit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1340 KavUpda.exe Token: SeIncBasePriorityPrivilege 1340 KavUpda.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 1340 KavUpda.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2616 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 20 PID 1728 wrote to memory of 2616 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 20 PID 1728 wrote to memory of 2616 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 20 PID 1728 wrote to memory of 2616 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 20 PID 1728 wrote to memory of 2632 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 16 PID 1728 wrote to memory of 2632 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 16 PID 1728 wrote to memory of 2632 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 16 PID 1728 wrote to memory of 2632 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 16 PID 2632 wrote to memory of 2732 2632 net.exe 17 PID 2632 wrote to memory of 2732 2632 net.exe 17 PID 2632 wrote to memory of 2732 2632 net.exe 17 PID 2632 wrote to memory of 2732 2632 net.exe 17 PID 1728 wrote to memory of 2816 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 74 PID 1728 wrote to memory of 2816 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 74 PID 1728 wrote to memory of 2816 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 74 PID 1728 wrote to memory of 2816 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 74 PID 1728 wrote to memory of 2656 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 73 PID 1728 wrote to memory of 2656 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 73 PID 1728 wrote to memory of 2656 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 73 PID 1728 wrote to memory of 2656 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 73 PID 1728 wrote to memory of 3004 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 71 PID 1728 wrote to memory of 3004 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 71 PID 1728 wrote to memory of 3004 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 71 PID 1728 wrote to memory of 3004 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 71 PID 1728 wrote to memory of 2824 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 69 PID 1728 wrote to memory of 2824 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 69 PID 1728 wrote to memory of 2824 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 69 PID 1728 wrote to memory of 2824 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 69 PID 1728 wrote to memory of 2700 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 68 PID 1728 wrote to memory of 2700 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 68 PID 1728 wrote to memory of 2700 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 68 PID 1728 wrote to memory of 2700 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 68 PID 1728 wrote to memory of 2688 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 65 PID 1728 wrote to memory of 2688 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 65 PID 1728 wrote to memory of 2688 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 65 PID 1728 wrote to memory of 2688 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 65 PID 1728 wrote to memory of 2524 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 63 PID 1728 wrote to memory of 2524 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 63 PID 1728 wrote to memory of 2524 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 63 PID 1728 wrote to memory of 2524 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 63 PID 2656 wrote to memory of 2532 2656 cmd.exe 147 PID 2656 wrote to memory of 2532 2656 cmd.exe 147 PID 2656 wrote to memory of 2532 2656 cmd.exe 147 PID 2656 wrote to memory of 2532 2656 cmd.exe 147 PID 1728 wrote to memory of 2572 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 60 PID 1728 wrote to memory of 2572 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 60 PID 1728 wrote to memory of 2572 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 60 PID 1728 wrote to memory of 2572 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 60 PID 3004 wrote to memory of 2644 3004 cmd.exe 59 PID 3004 wrote to memory of 2644 3004 cmd.exe 59 PID 3004 wrote to memory of 2644 3004 cmd.exe 59 PID 3004 wrote to memory of 2644 3004 cmd.exe 59 PID 2824 wrote to memory of 2016 2824 net.exe 58 PID 2824 wrote to memory of 2016 2824 net.exe 58 PID 2824 wrote to memory of 2016 2824 net.exe 58 PID 2824 wrote to memory of 2016 2824 net.exe 58 PID 1728 wrote to memory of 2368 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 57 PID 1728 wrote to memory of 2368 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 57 PID 1728 wrote to memory of 2368 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 57 PID 1728 wrote to memory of 2368 1728 2ab1bba297feb6086115d9f3ad81a7ab.exe 57 PID 2700 wrote to memory of 1580 2700 net.exe 136 PID 2700 wrote to memory of 1580 2700 net.exe 136 PID 2700 wrote to memory of 1580 2700 net.exe 136 PID 2700 wrote to memory of 1580 2700 net.exe 136 -
Views/modifies file attributes 1 TTPs 16 IoCs
pid Process 984 attrib.exe 2724 attrib.exe 1584 attrib.exe 2540 attrib.exe 608 attrib.exe 888 attrib.exe 2836 attrib.exe 1260 attrib.exe 1744 attrib.exe 1948 attrib.exe 3036 attrib.exe 1872 attrib.exe 2704 attrib.exe 1044 attrib.exe 880 attrib.exe 2752 attrib.exe
Processes
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y1⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y2⤵PID:2732
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Option.bat1⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\2ab1bba297feb6086115d9f3ad81a7ab.exe"C:\Users\Admin\AppData\Local\Temp\2ab1bba297feb6086115d9f3ad81a7ab.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:1488
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:2592
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\regedt32.sys2⤵
- Modifies visibility of file extensions in Explorer
- Blocks application from running via registry modification
- Sets file execution options in registry
- Runs regedit.exe
PID:756
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:848
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1340 -
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y3⤵PID:1976
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y4⤵PID:1064
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y3⤵PID:2984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y4⤵PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:900
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2372
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:1280
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:1696
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:2300 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:880
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled3⤵
- Launches sc.exe
PID:2376
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:1484 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:1044
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:328
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y3⤵PID:1044
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y3⤵PID:268
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y3⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 5:32:53 PM C:\Windows\Sysinf.bat3⤵PID:2384
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 5:29:53 PM C:\Windows\Sysinf.bat3⤵PID:1964
-
-
C:\Windows\SysWOW64\At.exeAt.exe 5:30:51 PM C:\Windows\Help\HelpCat.exe3⤵PID:2620
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:608
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2840
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:984
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2396
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2352
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1528
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2760
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:3008
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2948
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1580
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2584
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1344
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2532
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1736
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2020
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:752
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:812
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2068
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2620
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2412
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1484
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2300
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2160
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:3036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1972
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2316
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1628
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1536
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1508
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2080
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2752
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2552
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2912
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled2⤵
- Launches sc.exe
PID:2864
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:2368
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:2572
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:2524
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵PID:2688
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵
- Suspicious use of WriteProcessMemory
PID:2700
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:2824
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 5:32:50 PM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3004
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 5:29:50 PM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2656
-
-
C:\Windows\SysWOW64\At.exeAt.exe 5:30:48 PM C:\Windows\Help\HelpCat.exe2⤵PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\2ab1bba297feb6086115d9f3ad81a7ab~4.exe2ab1bba297feb6086115d9f3ad81a7ab~4.exe2⤵
- Executes dropped EXE
PID:1196
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Option.bat1⤵PID:804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:2004
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y1⤵PID:2036
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:2940
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:2932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:2076
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:1580
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d2⤵
- Views/modifies file attributes
PID:2540
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:2016
-
C:\Windows\SysWOW64\at.exeat 5:32:50 PM C:\Windows\Sysinf.bat1⤵PID:2644
-
C:\Windows\SysWOW64\at.exeat 5:29:50 PM C:\Windows\Sysinf.bat1⤵PID:2532
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1872
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:1856
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:1780
-
C:\Windows\SysWOW64\at.exeat 5:32:53 PM C:\Windows\Sysinf.bat1⤵PID:1392
-
C:\Windows\SysWOW64\at.exeat 5:29:53 PM C:\Windows\Sysinf.bat1⤵PID:928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:1456
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2724
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1584
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2704
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1744
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1948
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "15975216404765208881123474500-436266789-1329852590-1635191480-13023011281320824318"1⤵PID:1280
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:888
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2836