Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
3f6180e483c3c6b5010350388903a62e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3f6180e483c3c6b5010350388903a62e.exe
Resource
win10v2004-20231222-en
General
-
Target
3f6180e483c3c6b5010350388903a62e.exe
-
Size
901KB
-
MD5
3f6180e483c3c6b5010350388903a62e
-
SHA1
96cb99a5bc3ae87ba759c7bb6b384ce6ee1f9ca2
-
SHA256
326cb2b7e79526b3793bddfd61cb87883a59b931d1ad129b626252b560761e16
-
SHA512
3749dd7b5dda8380244b86b24e4e31f402303e10ac44cfce875824efe9d55debc7fa38cd118812893f61a0c674aa610c85cb93100cae1c30e14710a0c7c2a3a6
-
SSDEEP
6144:UZfec9EbXDk6Rk8KdrG1VVE+IVE2EJuHOtrG1VVE+IVE2EJuHOtrG1VVE+IVE2Ec:UZWtI6RkLudwORudwORudwORud0A
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" regedit.exe -
Blocks application from running via registry modification 17 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" regedit.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" regedit.exe -
Sets file execution options in registry 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe regedit.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Option.bat 3f6180e483c3c6b5010350388903a62e.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\regedt32.sys 3f6180e483c3c6b5010350388903a62e.exe File opened for modification C:\Windows\system\KavUpda.exe 3f6180e483c3c6b5010350388903a62e.exe File created C:\Windows\Help\HelpCat.exe 3f6180e483c3c6b5010350388903a62e.exe File opened for modification C:\Windows\Help\HelpCat.exe 3f6180e483c3c6b5010350388903a62e.exe File created C:\Windows\Sysinf.bat 3f6180e483c3c6b5010350388903a62e.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4300 sc.exe 4284 sc.exe 4332 sc.exe 4900 sc.exe 2500 sc.exe 4284 sc.exe 4788 sc.exe 3688 sc.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
pid Process 2860 regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2712 3f6180e483c3c6b5010350388903a62e.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2712 wrote to memory of 1464 2712 3f6180e483c3c6b5010350388903a62e.exe 17 PID 2712 wrote to memory of 1464 2712 3f6180e483c3c6b5010350388903a62e.exe 17 PID 2712 wrote to memory of 1464 2712 3f6180e483c3c6b5010350388903a62e.exe 17 PID 2712 wrote to memory of 2736 2712 3f6180e483c3c6b5010350388903a62e.exe 23 PID 2712 wrote to memory of 2736 2712 3f6180e483c3c6b5010350388903a62e.exe 23 PID 2712 wrote to memory of 2736 2712 3f6180e483c3c6b5010350388903a62e.exe 23 PID 2736 wrote to memory of 4680 2736 net.exe 21 PID 2736 wrote to memory of 4680 2736 net.exe 21 PID 2736 wrote to memory of 4680 2736 net.exe 21 PID 2712 wrote to memory of 4972 2712 3f6180e483c3c6b5010350388903a62e.exe 173 PID 2712 wrote to memory of 4972 2712 3f6180e483c3c6b5010350388903a62e.exe 173 PID 2712 wrote to memory of 4972 2712 3f6180e483c3c6b5010350388903a62e.exe 173 PID 2712 wrote to memory of 2136 2712 3f6180e483c3c6b5010350388903a62e.exe 165 PID 2712 wrote to memory of 2136 2712 3f6180e483c3c6b5010350388903a62e.exe 165 PID 2712 wrote to memory of 2136 2712 3f6180e483c3c6b5010350388903a62e.exe 165 PID 2712 wrote to memory of 440 2712 3f6180e483c3c6b5010350388903a62e.exe 115 PID 2712 wrote to memory of 440 2712 3f6180e483c3c6b5010350388903a62e.exe 115 PID 2712 wrote to memory of 440 2712 3f6180e483c3c6b5010350388903a62e.exe 115 PID 2712 wrote to memory of 1192 2712 3f6180e483c3c6b5010350388903a62e.exe 125 PID 2712 wrote to memory of 1192 2712 3f6180e483c3c6b5010350388903a62e.exe 125 PID 2712 wrote to memory of 1192 2712 3f6180e483c3c6b5010350388903a62e.exe 125 PID 2712 wrote to memory of 1456 2712 3f6180e483c3c6b5010350388903a62e.exe 98 PID 2712 wrote to memory of 1456 2712 3f6180e483c3c6b5010350388903a62e.exe 98 PID 2712 wrote to memory of 1456 2712 3f6180e483c3c6b5010350388903a62e.exe 98 PID 2712 wrote to memory of 3440 2712 3f6180e483c3c6b5010350388903a62e.exe 220 PID 2712 wrote to memory of 3440 2712 3f6180e483c3c6b5010350388903a62e.exe 220 PID 2712 wrote to memory of 3440 2712 3f6180e483c3c6b5010350388903a62e.exe 220 PID 2712 wrote to memory of 2080 2712 3f6180e483c3c6b5010350388903a62e.exe 95 PID 2712 wrote to memory of 2080 2712 3f6180e483c3c6b5010350388903a62e.exe 95 PID 2712 wrote to memory of 2080 2712 3f6180e483c3c6b5010350388903a62e.exe 95 PID 2712 wrote to memory of 4144 2712 3f6180e483c3c6b5010350388903a62e.exe 117 PID 2712 wrote to memory of 4144 2712 3f6180e483c3c6b5010350388903a62e.exe 117 PID 2712 wrote to memory of 4144 2712 3f6180e483c3c6b5010350388903a62e.exe 117 PID 2712 wrote to memory of 4300 2712 3f6180e483c3c6b5010350388903a62e.exe 223 PID 2712 wrote to memory of 4300 2712 3f6180e483c3c6b5010350388903a62e.exe 223 PID 2712 wrote to memory of 4300 2712 3f6180e483c3c6b5010350388903a62e.exe 223 PID 2712 wrote to memory of 3688 2712 3f6180e483c3c6b5010350388903a62e.exe 88 PID 2712 wrote to memory of 3688 2712 3f6180e483c3c6b5010350388903a62e.exe 88 PID 2712 wrote to memory of 3688 2712 3f6180e483c3c6b5010350388903a62e.exe 88 PID 2712 wrote to memory of 4788 2712 3f6180e483c3c6b5010350388903a62e.exe 86 PID 2712 wrote to memory of 4788 2712 3f6180e483c3c6b5010350388903a62e.exe 86 PID 2712 wrote to memory of 4788 2712 3f6180e483c3c6b5010350388903a62e.exe 86 PID 2712 wrote to memory of 4284 2712 3f6180e483c3c6b5010350388903a62e.exe 138 PID 2712 wrote to memory of 4284 2712 3f6180e483c3c6b5010350388903a62e.exe 138 PID 2712 wrote to memory of 4284 2712 3f6180e483c3c6b5010350388903a62e.exe 138 PID 2712 wrote to memory of 2860 2712 3f6180e483c3c6b5010350388903a62e.exe 61 PID 2712 wrote to memory of 2860 2712 3f6180e483c3c6b5010350388903a62e.exe 61 PID 2712 wrote to memory of 2860 2712 3f6180e483c3c6b5010350388903a62e.exe 61 PID 2712 wrote to memory of 3604 2712 3f6180e483c3c6b5010350388903a62e.exe 136 PID 2712 wrote to memory of 3604 2712 3f6180e483c3c6b5010350388903a62e.exe 136 PID 2712 wrote to memory of 3604 2712 3f6180e483c3c6b5010350388903a62e.exe 136 PID 2712 wrote to memory of 1148 2712 3f6180e483c3c6b5010350388903a62e.exe 113 PID 2712 wrote to memory of 1148 2712 3f6180e483c3c6b5010350388903a62e.exe 113 PID 2712 wrote to memory of 1148 2712 3f6180e483c3c6b5010350388903a62e.exe 113 PID 1192 wrote to memory of 1080 1192 net1.exe 63 PID 1192 wrote to memory of 1080 1192 net1.exe 63 PID 1192 wrote to memory of 1080 1192 net1.exe 63 PID 2080 wrote to memory of 4932 2080 net.exe 77 PID 2080 wrote to memory of 4932 2080 net.exe 77 PID 2080 wrote to memory of 4932 2080 net.exe 77 -
Views/modifies file attributes 1 TTPs 16 IoCs
pid Process 4100 attrib.exe 872 attrib.exe 4728 attrib.exe 1836 attrib.exe 5056 attrib.exe 868 attrib.exe 3788 attrib.exe 4300 attrib.exe 3812 attrib.exe 1920 attrib.exe 3996 attrib.exe 3288 attrib.exe 4884 attrib.exe 4508 attrib.exe 1972 attrib.exe 1704 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f6180e483c3c6b5010350388903a62e.exe"C:\Users\Admin\AppData\Local\Temp\3f6180e483c3c6b5010350388903a62e.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat2⤵PID:1464
-
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y2⤵
- Suspicious use of WriteProcessMemory
PID:2736
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵PID:3440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y3⤵PID:996
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:4284
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\regedt32.sys2⤵
- Modifies visibility of file extensions in Explorer
- Blocks application from running via registry modification
- Sets file execution options in registry
- Runs regedit.exe
PID:2860
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe2⤵PID:936
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y3⤵PID:2584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat3⤵PID:2688
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3440
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4604
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:4904
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:3604
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:4284
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled3⤵
- Launches sc.exe
PID:4332
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:4900
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:2500
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y3⤵PID:4928
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y3⤵PID:4484
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y3⤵PID:116
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y3⤵PID:4164
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y3⤵PID:1836
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 12:12:04 AM C:\Windows\Sysinf.bat3⤵PID:4408
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:464
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2404
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 12:09:04 AM C:\Windows\Sysinf.bat3⤵PID:3036
-
-
C:\Windows\SysWOW64\At.exeAt.exe 12:10:02 AM C:\Windows\Help\HelpCat.exe3⤵PID:1240
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:4784
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4056
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2984
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1028
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1440
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2244
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4556
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2896
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:4448
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3572
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2404
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4172
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:4612
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4264
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:5056
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4144
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1884
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:1836
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:400
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2212
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4264
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3496
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2220
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:4508
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1296
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1292
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2512
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2276
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:3408
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:3556
-
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:1148
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:3604
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4788
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled2⤵
- Launches sc.exe
PID:3688
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:4300
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:4144
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵
- Suspicious use of WriteProcessMemory
PID:2080
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:1456
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:1192
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 12:12:01 AM C:\Windows\Sysinf.bat2⤵PID:440
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:4144
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:1288
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵PID:4884
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:1044
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:4264
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵
- Views/modifies file attributes
PID:3812
-
-
-
C:\Users\Admin\AppData\Local\Temp\3f6180e483c3c6b5010350388903a62e~4.exe3f6180e483c3c6b5010350388903a62e~4.exe2⤵PID:2832
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 12:09:01 AM C:\Windows\Sysinf.bat2⤵PID:2136
-
-
C:\Windows\SysWOW64\At.exeAt.exe 12:09:59 AM C:\Windows\Help\HelpCat.exe2⤵PID:4972
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:4680
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:1080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:3880
-
C:\Windows\SysWOW64\at.exeat 12:09:01 AM C:\Windows\Sysinf.bat1⤵PID:3952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:4288
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:4100
-
C:\Windows\SysWOW64\at.exeat 12:12:01 AM C:\Windows\Sysinf.bat1⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:4932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:4144
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y2⤵PID:3604
-
-
C:\Windows\SysWOW64\at.exeat 12:09:04 AM C:\Windows\Sysinf.bat1⤵PID:2136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:4524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:1432
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:1148
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:4364
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵
- Suspicious use of WriteProcessMemory
PID:1192
-
C:\Windows\SysWOW64\at.exeat 12:12:04 AM C:\Windows\Sysinf.bat1⤵PID:456
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:1496
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:4288
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3788
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:4972
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3996
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4728
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3440
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4300
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4100
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:872
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3288
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4884
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1972
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1920
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD59bdf13167fbef8da3a4e9a558b169e5e
SHA19093adac07776a7c71b8b795b46a5d9f13f41e95
SHA2562471e5c2e6479bd322db0abff6a36147a8fa37e9e673bb8e8d0ee5fe2887547c
SHA5122e5a3b92253b9b04a092ebe36f6572f0eb85a97a6d41a59054918dcf9a6bb0b8aa0c70dff836d6c85d6302c81935383fe3b19c38df54556510dfbd119e6dde88
-
Filesize
460B
MD57db3d565d6ddbe65a8b0e093910e7dcd
SHA1d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA256a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
SHA5120b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b
-
Filesize
877KB
MD50f7a25c1e8be2fca7128a7d10501ca3f
SHA12b3ba4fe3b836fc76a6b031b09f89e64d637c574
SHA2568e9afb7681a302b2b4b1bbd99172e8251af9c00c3e6b74e4f2657cee8b218d52
SHA512aab023a458e7ed7c935339db5c18ca401b9f945f37092c9a78a4c7aee2c52c11bdd43c999e1725f4bae9966d012e8838720872b38cc9f08893ed544d5f0f714b
-
Filesize
92KB
MD59253be46af98a0b40c26d6bdd6a13107
SHA1e5c93a9d400921734c8ef43472432f5735d9a429
SHA256af5b86a2ec44ebd362552ba20cf8bdcaceab76c83d962a54b4c36b59dc9eb759
SHA512b6e2b37e962c2e17c38a519203e8817252cb53f812fb0722f52029dafa50ccc3a921db9707d7249d732d30b8359ecfa74c18e998b985792d265eb76c2c7b8589
-
Filesize
2KB
MD5e7d7ec66bd61fac3843c98650b0c68f6
SHA1a15ae06e1be51038863650746368a71024539bac
SHA2566475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
SHA512ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6