63c4bb88c34923db9788828192dade8d7850736d9a681c3dc9f6a90ae05c2d3f

Resubmissions

15/06/2024, 16:17

240615-trpk3szhrk 1

15/06/2024, 16:14

240615-tpvpbawgre 1

15/06/2024, 16:11

240615-tmyceswgmc 3

15/06/2024, 16:07

240615-tk2l3awfrh 1

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ghost.bat
Size

28B
MD5

0aea348c791992cc0a5124925ebcb4f5
SHA1

cd2c331b3f72c8a681b76f59dfe09b825f36caf4
SHA256

63c4bb88c34923db9788828192dade8d7850736d9a681c3dc9f6a90ae05c2d3f
SHA512

bb08ce72a106e1cbc90b148a64826f0a9c502197f1fe0cbc250eb7f5e0b7f118d964fadcf44e2d408f584343a417890a75d8813662006f265a816ce793bad64e

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4908	Notepad.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14064	dwm.exe
Token: SeChangeNotifyPrivilege	14064	dwm.exe
Token: 33	14064	dwm.exe
Token: SeIncBasePriorityPrivilege	14064	dwm.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	OpenWith.exe
3600	OpenWith.exe
3600	OpenWith.exe
3600	OpenWith.exe
3600	OpenWith.exe
3600	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2272	2480	cmd.exe	84
PID 2480 wrote to memory of 2272	2480	cmd.exe	84
PID 2480 wrote to memory of 856	2480	cmd.exe	86
PID 2480 wrote to memory of 856	2480	cmd.exe	86
PID 2480 wrote to memory of 3596	2480	cmd.exe	88
PID 2480 wrote to memory of 3596	2480	cmd.exe	88
PID 2480 wrote to memory of 4496	2480	cmd.exe	90
PID 2480 wrote to memory of 4496	2480	cmd.exe	90
PID 2480 wrote to memory of 2580	2480	cmd.exe	92
PID 2480 wrote to memory of 2580	2480	cmd.exe	92
PID 2480 wrote to memory of 4360	2480	cmd.exe	94
PID 2480 wrote to memory of 4360	2480	cmd.exe	94
PID 2480 wrote to memory of 2196	2480	cmd.exe	96
PID 2480 wrote to memory of 2196	2480	cmd.exe	96
PID 2480 wrote to memory of 3680	2480	cmd.exe	97
PID 2480 wrote to memory of 3680	2480	cmd.exe	97
PID 2480 wrote to memory of 2704	2480	cmd.exe	100
PID 2480 wrote to memory of 2704	2480	cmd.exe	100
PID 2480 wrote to memory of 3448	2480	cmd.exe	101
PID 2480 wrote to memory of 3448	2480	cmd.exe	101
PID 2480 wrote to memory of 3012	2480	cmd.exe	104
PID 2480 wrote to memory of 3012	2480	cmd.exe	104
PID 2480 wrote to memory of 2836	2480	cmd.exe	105
PID 2480 wrote to memory of 2836	2480	cmd.exe	105
PID 2480 wrote to memory of 3732	2480	cmd.exe	107
PID 2480 wrote to memory of 3732	2480	cmd.exe	107
PID 2480 wrote to memory of 4596	2480	cmd.exe	111
PID 2480 wrote to memory of 4596	2480	cmd.exe	111
PID 2480 wrote to memory of 4700	2480	cmd.exe	114
PID 2480 wrote to memory of 4700	2480	cmd.exe	114
PID 2480 wrote to memory of 1156	2480	cmd.exe	116
PID 2480 wrote to memory of 1156	2480	cmd.exe	116
PID 2480 wrote to memory of 920	2480	cmd.exe	118
PID 2480 wrote to memory of 920	2480	cmd.exe	118
PID 2480 wrote to memory of 4952	2480	cmd.exe	120
PID 2480 wrote to memory of 4952	2480	cmd.exe	120
PID 2480 wrote to memory of 1736	2480	cmd.exe	122
PID 2480 wrote to memory of 1736	2480	cmd.exe	122
PID 2480 wrote to memory of 5092	2480	cmd.exe	124
PID 2480 wrote to memory of 5092	2480	cmd.exe	124
PID 2480 wrote to memory of 4984	2480	cmd.exe	126
PID 2480 wrote to memory of 4984	2480	cmd.exe	126
PID 2480 wrote to memory of 4920	2480	cmd.exe	128
PID 2480 wrote to memory of 4920	2480	cmd.exe	128
PID 2480 wrote to memory of 3940	2480	cmd.exe	130
PID 2480 wrote to memory of 3940	2480	cmd.exe	130
PID 2480 wrote to memory of 3564	2480	cmd.exe	132
PID 2480 wrote to memory of 3564	2480	cmd.exe	132
PID 2480 wrote to memory of 4712	2480	cmd.exe	134
PID 2480 wrote to memory of 4712	2480	cmd.exe	134
PID 2480 wrote to memory of 756	2480	cmd.exe	135
PID 2480 wrote to memory of 756	2480	cmd.exe	135
PID 2480 wrote to memory of 4092	2480	cmd.exe	138
PID 2480 wrote to memory of 4092	2480	cmd.exe	138
PID 2480 wrote to memory of 2476	2480	cmd.exe	140
PID 2480 wrote to memory of 2476	2480	cmd.exe	140
PID 2480 wrote to memory of 2532	2480	cmd.exe	142
PID 2480 wrote to memory of 2532	2480	cmd.exe	142
PID 2480 wrote to memory of 3792	2480	cmd.exe	143
PID 2480 wrote to memory of 3792	2480	cmd.exe	143
PID 2480 wrote to memory of 4324	2480	cmd.exe	146
PID 2480 wrote to memory of 4324	2480	cmd.exe	146
PID 2480 wrote to memory of 4244	2480	cmd.exe	147
PID 2480 wrote to memory of 4244	2480	cmd.exe	147

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Ghost.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2272
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3596
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4496
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2580
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2196
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3680
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2704
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3448
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3012
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2836
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3732
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4596
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4700
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1156
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:920
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4952
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1736
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5092
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4984
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4920
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3940
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3564
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4712
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:756
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4092
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2476
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4324
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4244
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1480
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5140
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5148
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5324
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5348
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5412
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5448
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5480
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5504
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5540
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5592
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5816

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\totally not a virus (1).txt
1⤵
PID:5680

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\totally not a virus.bat
1⤵
PID:1584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3600
- C:\Program Files\Windows Mail\wab.exe
  "C:\Program Files\Windows Mail\wab.exe" /contact "C:\Users\Admin\Desktop\SavePing.contact"
  2⤵
  PID:5588

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\RequestUnlock.js
1⤵
- Opens file in notepad (likely ransom note)
PID:4908

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\RequestUnlock.js"
1⤵
PID:5580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\totally not a virus.bat" "
1⤵
PID:4928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3592
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5400
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2484
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4324
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4256
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5604
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4512
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2012
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3836
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4232
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:464
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3828
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2512
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3576
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6048
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3604
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5892
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3128
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5252
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1548
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5464
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1836
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4316
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6024
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5732
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6036
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6028
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4352
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4308
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5228
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5488
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5724
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3772
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4168
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1980
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:220
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4700
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4484
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5196
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4940
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1388
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5172
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1760
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3112
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1468
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3012
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5432
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4844
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2900
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6160
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6184
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6192
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6364
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6388
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6396
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6420
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6428
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6436
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6444
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6452
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6476
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6580
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6592
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6876
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6900
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7060
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7076
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7084
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7092
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7100
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7108
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7116
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7124
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7184
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7368
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7388
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7396
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7404
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7412
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7692
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7700
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7716
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7724
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7736
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7744
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7752
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7760
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7768
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7776
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7784
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7800
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7808
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7824
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7840
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8324
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8332
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8356
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8448
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8540
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8552
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8652
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9088
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9136
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9144
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9152
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9160
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9168
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4180
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4228
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9124
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8376
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9220
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9228
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9236
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9244
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9252
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9864
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9872
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9880
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9888
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9896
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9904
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9920
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9936
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9944
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9952
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9968
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9976
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9984
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9992
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10008
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10016
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10024
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10032
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10040
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10048
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10056
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10064
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10072
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10080
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10088
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10104
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10172
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10180
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11088
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11344
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11352
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11368
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11376
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11384
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11712
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11720
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11728
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11776
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11784
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11800
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11808
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11824
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11840
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11864
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11872
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11880
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11888
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11896
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11904
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11920
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11936
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11944
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11952
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11968
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11976
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11984
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11992
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12008
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12016
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12024
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12032
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12040
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12048
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12056
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12064
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12072
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12080
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12088
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12104
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12112
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12120
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12128
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12136
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12144
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12152
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12160
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12168
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12184
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12192
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12200
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12216
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12224

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\totally not a virus.bat

Filesize
28B

MD5
0aea348c791992cc0a5124925ebcb4f5

SHA1
cd2c331b3f72c8a681b76f59dfe09b825f36caf4

SHA256
63c4bb88c34923db9788828192dade8d7850736d9a681c3dc9f6a90ae05c2d3f

SHA512
bb08ce72a106e1cbc90b148a64826f0a9c502197f1fe0cbc250eb7f5e0b7f118d964fadcf44e2d408f584343a417890a75d8813662006f265a816ce793bad64e

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads