cf27e4b24ab9c6eb256acf3634df0639f7ff57956fb51cfca1d46b60cc2b5149

Analysis

max time kernel
2s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a63f8e0cbc359701100a3745dd9c4610.exe
Size 2.6MB
Sample240107-xst4qschf8
SHA256 cf27e4b24ab9c6eb256acf3634df0639f7ff57956fb51cfca1d46b60cc2b5149
MD5 a63f8e0cbc359701100a3745dd9c4610
SHA1 74c05b164033343ce61aedee9c7d3685096ce440
SHA512 f0c85df61f8846192fb95462069602b4300d0080d3de9e9868ae95f49a6c86ca1f72d01fccfbb9048222939140e28ed2feec962b0fb6567e897b59b6e1dd329b
SSDEEP 24576:UuhaWBlOA2eZJ8NI8kO0PyJV3h+VYO8EOiBpNx2fD3CPkKnsfBOBidUi:bV8kVPaSY8L2fDC5sf3t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Blocks application from running via registry modification 17 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe"	regedit.exe

Sets file execution options in registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe	regedit.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	a63f8e0cbc359701100a3745dd9c4610.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\HelpCat.exe	a63f8e0cbc359701100a3745dd9c4610.exe
File created	C:\Windows\Sysinf.bat	a63f8e0cbc359701100a3745dd9c4610.exe
File created	C:\Windows\regedt32.sys	a63f8e0cbc359701100a3745dd9c4610.exe
File opened for modification	C:\Windows\system\KavUpda.exe	a63f8e0cbc359701100a3745dd9c4610.exe
File created	C:\Windows\Help\HelpCat.exe	a63f8e0cbc359701100a3745dd9c4610.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2228	sc.exe
4368	sc.exe
3288	sc.exe
4848	sc.exe
4632	sc.exe
548	sc.exe
4552	sc.exe
4932	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
868	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2108	a63f8e0cbc359701100a3745dd9c4610.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2080	2108	a63f8e0cbc359701100a3745dd9c4610.exe	89
PID 2108 wrote to memory of 2080	2108	a63f8e0cbc359701100a3745dd9c4610.exe	89
PID 2108 wrote to memory of 2080	2108	a63f8e0cbc359701100a3745dd9c4610.exe	89
PID 2108 wrote to memory of 4904	2108	a63f8e0cbc359701100a3745dd9c4610.exe	94
PID 2108 wrote to memory of 4904	2108	a63f8e0cbc359701100a3745dd9c4610.exe	94
PID 2108 wrote to memory of 4904	2108	a63f8e0cbc359701100a3745dd9c4610.exe	94
PID 4904 wrote to memory of 2872	4904	net.exe	91
PID 4904 wrote to memory of 2872	4904	net.exe	91
PID 4904 wrote to memory of 2872	4904	net.exe	91
PID 2108 wrote to memory of 2848	2108	a63f8e0cbc359701100a3745dd9c4610.exe	139
PID 2108 wrote to memory of 2848	2108	a63f8e0cbc359701100a3745dd9c4610.exe	139
PID 2108 wrote to memory of 2848	2108	a63f8e0cbc359701100a3745dd9c4610.exe	139
PID 2108 wrote to memory of 464	2108	a63f8e0cbc359701100a3745dd9c4610.exe	138
PID 2108 wrote to memory of 464	2108	a63f8e0cbc359701100a3745dd9c4610.exe	138
PID 2108 wrote to memory of 464	2108	a63f8e0cbc359701100a3745dd9c4610.exe	138
PID 2108 wrote to memory of 3408	2108	a63f8e0cbc359701100a3745dd9c4610.exe	137
PID 2108 wrote to memory of 3408	2108	a63f8e0cbc359701100a3745dd9c4610.exe	137
PID 2108 wrote to memory of 3408	2108	a63f8e0cbc359701100a3745dd9c4610.exe	137
PID 2108 wrote to memory of 1804	2108	a63f8e0cbc359701100a3745dd9c4610.exe	135
PID 2108 wrote to memory of 1804	2108	a63f8e0cbc359701100a3745dd9c4610.exe	135
PID 2108 wrote to memory of 1804	2108	a63f8e0cbc359701100a3745dd9c4610.exe	135
PID 2108 wrote to memory of 4092	2108	a63f8e0cbc359701100a3745dd9c4610.exe	134
PID 2108 wrote to memory of 4092	2108	a63f8e0cbc359701100a3745dd9c4610.exe	134
PID 2108 wrote to memory of 4092	2108	a63f8e0cbc359701100a3745dd9c4610.exe	134
PID 2108 wrote to memory of 1424	2108	a63f8e0cbc359701100a3745dd9c4610.exe	132
PID 2108 wrote to memory of 1424	2108	a63f8e0cbc359701100a3745dd9c4610.exe	132
PID 2108 wrote to memory of 1424	2108	a63f8e0cbc359701100a3745dd9c4610.exe	132
PID 2108 wrote to memory of 3584	2108	a63f8e0cbc359701100a3745dd9c4610.exe	207
PID 2108 wrote to memory of 3584	2108	a63f8e0cbc359701100a3745dd9c4610.exe	207
PID 2108 wrote to memory of 3584	2108	a63f8e0cbc359701100a3745dd9c4610.exe	207
PID 2108 wrote to memory of 4440	2108	a63f8e0cbc359701100a3745dd9c4610.exe	127
PID 2108 wrote to memory of 4440	2108	a63f8e0cbc359701100a3745dd9c4610.exe	127
PID 2108 wrote to memory of 4440	2108	a63f8e0cbc359701100a3745dd9c4610.exe	127
PID 2108 wrote to memory of 4368	2108	a63f8e0cbc359701100a3745dd9c4610.exe	175
PID 2108 wrote to memory of 4368	2108	a63f8e0cbc359701100a3745dd9c4610.exe	175
PID 2108 wrote to memory of 4368	2108	a63f8e0cbc359701100a3745dd9c4610.exe	175
PID 2108 wrote to memory of 2228	2108	a63f8e0cbc359701100a3745dd9c4610.exe	123
PID 2108 wrote to memory of 2228	2108	a63f8e0cbc359701100a3745dd9c4610.exe	123
PID 2108 wrote to memory of 2228	2108	a63f8e0cbc359701100a3745dd9c4610.exe	123
PID 2108 wrote to memory of 4932	2108	a63f8e0cbc359701100a3745dd9c4610.exe	121
PID 2108 wrote to memory of 4932	2108	a63f8e0cbc359701100a3745dd9c4610.exe	121
PID 2108 wrote to memory of 4932	2108	a63f8e0cbc359701100a3745dd9c4610.exe	121
PID 2108 wrote to memory of 4552	2108	a63f8e0cbc359701100a3745dd9c4610.exe	119
PID 2108 wrote to memory of 4552	2108	a63f8e0cbc359701100a3745dd9c4610.exe	119
PID 2108 wrote to memory of 4552	2108	a63f8e0cbc359701100a3745dd9c4610.exe	119
PID 2108 wrote to memory of 868	2108	a63f8e0cbc359701100a3745dd9c4610.exe	117
PID 2108 wrote to memory of 868	2108	a63f8e0cbc359701100a3745dd9c4610.exe	117
PID 2108 wrote to memory of 868	2108	a63f8e0cbc359701100a3745dd9c4610.exe	117
PID 2108 wrote to memory of 1896	2108	a63f8e0cbc359701100a3745dd9c4610.exe	116
PID 2108 wrote to memory of 1896	2108	a63f8e0cbc359701100a3745dd9c4610.exe	116
PID 2108 wrote to memory of 1896	2108	a63f8e0cbc359701100a3745dd9c4610.exe	116
PID 2108 wrote to memory of 2816	2108	a63f8e0cbc359701100a3745dd9c4610.exe	115
PID 2108 wrote to memory of 2816	2108	a63f8e0cbc359701100a3745dd9c4610.exe	115
PID 2108 wrote to memory of 2816	2108	a63f8e0cbc359701100a3745dd9c4610.exe	115
PID 1804 wrote to memory of 3416	1804	net.exe	142
PID 1804 wrote to memory of 3416	1804	net.exe	142
PID 1804 wrote to memory of 3416	1804	net.exe	142
PID 4440 wrote to memory of 1500	4440	net.exe	113
PID 4440 wrote to memory of 1500	4440	net.exe	113
PID 4440 wrote to memory of 1500	4440	net.exe	113
PID 1424 wrote to memory of 3760	1424	net.exe	239
PID 1424 wrote to memory of 3760	1424	net.exe	239
PID 1424 wrote to memory of 3760	1424	net.exe	239
PID 4092 wrote to memory of 2076	4092	net.exe	111

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4172	attrib.exe
5116	attrib.exe
4200	attrib.exe
4404	attrib.exe
3288	attrib.exe
2124	attrib.exe
2240	attrib.exe
4372	attrib.exe
1224	attrib.exe
4656	attrib.exe
668	attrib.exe
3648	attrib.exe
1448	attrib.exe
1196	attrib.exe
4312	attrib.exe
4692	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a63f8e0cbc359701100a3745dd9c4610.exe
"C:\Users\Admin\AppData\Local\Temp\a63f8e0cbc359701100a3745dd9c4610.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  PID:2080
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\net.exe
    net.exe start schedule /y
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    PID:5036
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:3288
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4848
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:4632
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:548
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 7:13:29 PM C:\Windows\Sysinf.bat
    3⤵
    PID:884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 7:10:29 PM C:\Windows\Sysinf.bat
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\At.exe
    At.exe 7:11:27 PM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:796
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4300
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:2816
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:1896
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Blocks application from running via registry modification
  - Sets file execution options in registry
  - Runs regedit.exe
  PID:868
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:4552
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4932
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:2228
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:4368
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:3584
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1424
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 7:13:26 PM C:\Windows\Sysinf.bat
  2⤵
  PID:3408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 7:10:26 PM C:\Windows\Sysinf.bat
  2⤵
  PID:464
- C:\Windows\SysWOW64\At.exe
  At.exe 7:11:24 PM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:2848
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1248
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    - Views/modifies file attributes
    PID:4200
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2356
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:2340
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\a63f8e0cbc359701100a3745dd9c4610~4.exe
  a63f8e0cbc359701100a3745dd9c4610~4.exe
  2⤵
  PID:5064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:2872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:3416

C:\Windows\SysWOW64\at.exe
at 7:10:26 PM C:\Windows\Sysinf.bat
1⤵
PID:4196

C:\Windows\SysWOW64\at.exe
at 7:13:26 PM C:\Windows\Sysinf.bat
1⤵
PID:4884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:3944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:2872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:2076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:3760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:1500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:2212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:4508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:3960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1040

C:\Windows\SysWOW64\at.exe
at 7:13:29 PM C:\Windows\Sysinf.bat
1⤵
PID:1352

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:4344

C:\Windows\SysWOW64\at.exe
at 7:10:29 PM C:\Windows\Sysinf.bat
1⤵
PID:4884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:3820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:4628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:5012

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4368

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3584

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1196

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3288

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4312

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2124

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4172

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4372

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1224

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:5116

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4656

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:668

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2240

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 82B
SHA256 e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7
MD5 3f7fbd2eb34892646e93fd5e6e343512
SHA1 265ac1061b54f62350fb7a5f57e566454d013a66
SHA512 53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140
MD5 SHA1 SHA512

Submit Download

memory/2108-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads