bfc092b384976e97153bae0e29359461bfd65fce5ad8188d6460de57bc680eaf

Analysis

max time kernel
147s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1/b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
Size

808KB
MD5

4ac882ebdbc1431cdd3ab45e1712ada1
SHA1

b871304fd060b700fd66ce0c87014ec955d12979
SHA256

b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6
SHA512

f3ff8d00849289436b723bc48c14113e51b583955d7f69870458d7b7d72ba214ad531d601a950b247f43325a610fd15cd6584008fd842a29c1dd0804ee2e6f98
SSDEEP

24576:65MOrT+F0sIE9JqsC6mVFyCsffzMS6pcsP9Qtce0TBs/lPsoCyEbDb7Br5oANn90:+bjnS

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QoLpdpChtageWWBFQpqETZsG\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\QoLpdpChtageWWBFQpqETZsG"	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3120	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	87
PID 2012 wrote to memory of 3120	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	87
PID 2012 wrote to memory of 2988	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	88
PID 2012 wrote to memory of 2988	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	88
PID 2012 wrote to memory of 3020	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	89
PID 2012 wrote to memory of 3020	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	89
PID 2012 wrote to memory of 116	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	90
PID 2012 wrote to memory of 116	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	90
PID 2012 wrote to memory of 3152	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	91
PID 2012 wrote to memory of 3152	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	91
PID 2012 wrote to memory of 536	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	92
PID 2012 wrote to memory of 536	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	92
PID 2012 wrote to memory of 4472	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	93
PID 2012 wrote to memory of 4472	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	93
PID 2012 wrote to memory of 3516	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	94
PID 2012 wrote to memory of 3516	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	94
PID 2012 wrote to memory of 3652	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	95
PID 2012 wrote to memory of 3652	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	95
PID 2012 wrote to memory of 2844	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	96
PID 2012 wrote to memory of 2844	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	96
PID 2012 wrote to memory of 3496	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	97
PID 2012 wrote to memory of 3496	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	97
PID 2012 wrote to memory of 2284	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	98
PID 2012 wrote to memory of 2284	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	98
PID 2012 wrote to memory of 1576	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	99
PID 2012 wrote to memory of 1576	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	99
PID 2012 wrote to memory of 1788	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	100
PID 2012 wrote to memory of 1788	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	100
PID 2012 wrote to memory of 3292	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	101
PID 2012 wrote to memory of 3292	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	101
PID 2012 wrote to memory of 628	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	102
PID 2012 wrote to memory of 628	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	102
PID 2012 wrote to memory of 2736	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	103
PID 2012 wrote to memory of 2736	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	103
PID 2012 wrote to memory of 4056	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	106
PID 2012 wrote to memory of 4056	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	106
PID 2012 wrote to memory of 3508	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	107
PID 2012 wrote to memory of 3508	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	107
PID 2012 wrote to memory of 2792	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	109
PID 2012 wrote to memory of 2792	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	109
PID 2012 wrote to memory of 4348	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	110
PID 2012 wrote to memory of 4348	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	110
PID 2012 wrote to memory of 4116	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	111
PID 2012 wrote to memory of 4116	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	111
PID 2012 wrote to memory of 380	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	112
PID 2012 wrote to memory of 380	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	112
PID 2012 wrote to memory of 760	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	113
PID 2012 wrote to memory of 760	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	113
PID 2012 wrote to memory of 3524	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	114
PID 2012 wrote to memory of 3524	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	114
PID 2012 wrote to memory of 4940	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	115
PID 2012 wrote to memory of 4940	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	115
PID 2012 wrote to memory of 3492	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	116
PID 2012 wrote to memory of 3492	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	116
PID 2012 wrote to memory of 1992	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	117
PID 2012 wrote to memory of 1992	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	117
PID 2012 wrote to memory of 960	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	118
PID 2012 wrote to memory of 960	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	118
PID 2012 wrote to memory of 2036	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	119
PID 2012 wrote to memory of 2036	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	119
PID 2012 wrote to memory of 4736	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	120
PID 2012 wrote to memory of 4736	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	120
PID 2012 wrote to memory of 2352	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	121
PID 2012 wrote to memory of 2352	2012	b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe	121

C:\Users\Admin\AppData\Local\Temp\1\b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
"C:\Users\Admin\AppData\Local\Temp\1\b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads