67e716cde3c61703f54e8584bfaf47c286c04e4c46cd0ea8ffee7ed0861f060f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

idk.bat
Size

151B
MD5

218810dc51beb578fbbc5eef670b800c
SHA1

2e24365563a6793bee2553199c6bdb8980a81c85
SHA256

67e716cde3c61703f54e8584bfaf47c286c04e4c46cd0ea8ffee7ed0861f060f
SHA512

a91b710e8f0d38a31eec4566d5aa374844536d7662a74c84efc9e7e4a9bf4762fb82daead6a34c43f18583e583a2eb41ad92a87d92749ac061dc41b0fada61cc

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\qjn76k.exe	cmd.exe

Kills process with taskkill 45 IoCs

evasion

pid	Process
2920	taskkill.exe
2012	taskkill.exe
4196	taskkill.exe
4364	taskkill.exe
1464	taskkill.exe
4592	taskkill.exe
2144	taskkill.exe
2896	taskkill.exe
2624	taskkill.exe
3024	taskkill.exe
1136	taskkill.exe
4968	taskkill.exe
3200	taskkill.exe
3496	taskkill.exe
2524	taskkill.exe
4924	taskkill.exe
4876	taskkill.exe
2556	taskkill.exe
2888	taskkill.exe
4300	taskkill.exe
5116	taskkill.exe
3856	taskkill.exe
4764	taskkill.exe
4388	taskkill.exe
3220	taskkill.exe
1280	taskkill.exe
4764	taskkill.exe
4812	taskkill.exe
444	taskkill.exe
2296	taskkill.exe
1688	taskkill.exe
4392	taskkill.exe
4884	taskkill.exe
3744	taskkill.exe
4320	taskkill.exe
1760	taskkill.exe
3748	taskkill.exe
4484	taskkill.exe
4084	taskkill.exe
2848	taskkill.exe
4816	taskkill.exe
4524	taskkill.exe
2472	taskkill.exe
4876	taskkill.exe
2524	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2632	tskill.exe
2632	tskill.exe
1956	tskill.exe
1956	tskill.exe
4560	tskill.exe
4560	tskill.exe
1916	tskill.exe
1916	tskill.exe
4776	tskill.exe
4776	tskill.exe
4392	tskill.exe
4392	tskill.exe
5032	tskill.exe
5032	tskill.exe
4716	tskill.exe
4716	tskill.exe
2976	tskill.exe
2976	tskill.exe
1368	tskill.exe
1368	tskill.exe
2140	tskill.exe
2140	tskill.exe
3704	tskill.exe
3704	tskill.exe
1116	tskill.exe
1116	tskill.exe
4984	tskill.exe
4984	tskill.exe
2884	tskill.exe
2884	tskill.exe
4776	tskill.exe
4776	tskill.exe
4296	tskill.exe
4296	tskill.exe
4172	tskill.exe
4172	tskill.exe
4976	tskill.exe
4976	tskill.exe
3208	tskill.exe
3208	tskill.exe
2624	tskill.exe
2624	tskill.exe
3512	tskill.exe
3512	tskill.exe
4236	tskill.exe
4236	tskill.exe
3704	tskill.exe
3704	tskill.exe
4904	tskill.exe
4904	tskill.exe
3856	tskill.exe
3856	tskill.exe
2924	tskill.exe
2924	tskill.exe
1856	tskill.exe
1856	tskill.exe
1780	tskill.exe
1780	tskill.exe
4032	tskill.exe
4032	tskill.exe
4452	tskill.exe
4452	tskill.exe
2092	tskill.exe
2092	tskill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2888	5028	cmd.exe	100
PID 5028 wrote to memory of 2888	5028	cmd.exe	100
PID 5028 wrote to memory of 2632	5028	cmd.exe	101
PID 5028 wrote to memory of 2632	5028	cmd.exe	101
PID 5028 wrote to memory of 2976	5028	cmd.exe	102
PID 5028 wrote to memory of 2976	5028	cmd.exe	102
PID 2976 wrote to memory of 4708	2976	net.exe	103
PID 2976 wrote to memory of 4708	2976	net.exe	103
PID 5028 wrote to memory of 2624	5028	cmd.exe	105
PID 5028 wrote to memory of 2624	5028	cmd.exe	105
PID 5028 wrote to memory of 1956	5028	cmd.exe	106
PID 5028 wrote to memory of 1956	5028	cmd.exe	106
PID 5028 wrote to memory of 1368	5028	cmd.exe	107
PID 5028 wrote to memory of 1368	5028	cmd.exe	107
PID 1368 wrote to memory of 4320	1368	net.exe	108
PID 1368 wrote to memory of 4320	1368	net.exe	108
PID 5028 wrote to memory of 4364	5028	cmd.exe	110
PID 5028 wrote to memory of 4364	5028	cmd.exe	110
PID 5028 wrote to memory of 4560	5028	cmd.exe	111
PID 5028 wrote to memory of 4560	5028	cmd.exe	111
PID 5028 wrote to memory of 3704	5028	cmd.exe	112
PID 5028 wrote to memory of 3704	5028	cmd.exe	112
PID 3704 wrote to memory of 2524	3704	net.exe	113
PID 3704 wrote to memory of 2524	3704	net.exe	113
PID 5028 wrote to memory of 1464	5028	cmd.exe	114
PID 5028 wrote to memory of 1464	5028	cmd.exe	114
PID 5028 wrote to memory of 1916	5028	cmd.exe	115
PID 5028 wrote to memory of 1916	5028	cmd.exe	115
PID 5028 wrote to memory of 4492	5028	cmd.exe	116
PID 5028 wrote to memory of 4492	5028	cmd.exe	116
PID 4492 wrote to memory of 1596	4492	net.exe	117
PID 4492 wrote to memory of 1596	4492	net.exe	117
PID 5028 wrote to memory of 2472	5028	cmd.exe	118
PID 5028 wrote to memory of 2472	5028	cmd.exe	118
PID 5028 wrote to memory of 4776	5028	cmd.exe	119
PID 5028 wrote to memory of 4776	5028	cmd.exe	119
PID 5028 wrote to memory of 1780	5028	cmd.exe	120
PID 5028 wrote to memory of 1780	5028	cmd.exe	120
PID 1780 wrote to memory of 460	1780	net.exe	121
PID 1780 wrote to memory of 460	1780	net.exe	121
PID 5028 wrote to memory of 4388	5028	cmd.exe	122
PID 5028 wrote to memory of 4388	5028	cmd.exe	122
PID 5028 wrote to memory of 4392	5028	cmd.exe	123
PID 5028 wrote to memory of 4392	5028	cmd.exe	123
PID 5028 wrote to memory of 3248	5028	cmd.exe	124
PID 5028 wrote to memory of 3248	5028	cmd.exe	124
PID 3248 wrote to memory of 4296	3248	net.exe	125
PID 3248 wrote to memory of 4296	3248	net.exe	125
PID 5028 wrote to memory of 4300	5028	cmd.exe	126
PID 5028 wrote to memory of 4300	5028	cmd.exe	126
PID 5028 wrote to memory of 5032	5028	cmd.exe	127
PID 5028 wrote to memory of 5032	5028	cmd.exe	127
PID 5028 wrote to memory of 4988	5028	cmd.exe	129
PID 5028 wrote to memory of 4988	5028	cmd.exe	129
PID 4988 wrote to memory of 856	4988	net.exe	130
PID 4988 wrote to memory of 856	4988	net.exe	130
PID 5028 wrote to memory of 4876	5028	cmd.exe	131
PID 5028 wrote to memory of 4876	5028	cmd.exe	131
PID 5028 wrote to memory of 4716	5028	cmd.exe	132
PID 5028 wrote to memory of 4716	5028	cmd.exe	132
PID 5028 wrote to memory of 4624	5028	cmd.exe	133
PID 5028 wrote to memory of 4624	5028	cmd.exe	133
PID 4624 wrote to memory of 4556	4624	net.exe	134
PID 4624 wrote to memory of 4556	4624	net.exe	134

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\idk.bat"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2888
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4708
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2624
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4320
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4364
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2524
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:1464
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1596
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2472
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:460
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4388
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4296
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4300
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:856
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4876
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4556
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:5116
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2100
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4320
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4028
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4592
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2556
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2524
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1576
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4912
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4924
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2008
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:1688
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4764
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3200
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:3220
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3496
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1780
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4392
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4788
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4484
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:3908
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3024
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4876
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:1760
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4640
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4024
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2920
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:2100
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1276
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:1136
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3980
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2612
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2012
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:3900
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2524
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4912
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1576
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2144
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4512
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2388
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4884
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:2228
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:3328
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4764
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3200
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4800
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3220
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4816
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:3596
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4812
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:2816
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4228
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3748
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4636
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:3452
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4968
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1160
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1352
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4084
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:2040
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4460
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4876
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:1212
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:2656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:3216
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3744
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:3676
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:4604
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1032
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2556
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:972
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:2484
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:216
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2896
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:528
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1984
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2184
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:1280
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:4476
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2956
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2848
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:316
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2008
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3856
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:844
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1996
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4764
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:5100
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:1596
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:2924
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4196
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:1588
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3220
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1856
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4816
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:3332
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:784
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4336
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:444
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:2004
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3732
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:3748
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4524
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:4636
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:3088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:4400
- C:\Windows\system32\taskkill.exe
  taskkill explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2296
- C:\Windows\system32\tskill.exe
  tskill explorer.exe
  2⤵
  PID:4640
- C:\Windows\system32\net.exe
  net user /add
  2⤵
  PID:2064
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add
    3⤵
    PID:1624

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads