description	ioc	Process
File created	C:\Windows\System32\iamthedoom.bat	wscript.exe
File opened for modification	C:\Windows\System32\iamthedoom.bat	wscript.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\SwapMouseButtons = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	wscript.exe

pid	Process
4864	notepad.exe
5020	notepad.exe
2144	notepad.exe
2120	notepad.exe
3800	notepad.exe
3148	notepad.exe
2976	notepad.exe
2768	notepad.exe
4220	notepad.exe
1000	notepad.exe
572	notepad.exe
2788	notepad.exe

description	pid	Process
Token: SeBackupPrivilege	3508	vssvc.exe
Token: SeRestorePrivilege	3508	vssvc.exe
Token: SeAuditPrivilege	3508	vssvc.exe
Token: SeDebugPrivilege	1364	taskkill.exe

description	pid	Process	procid_target
PID 3776 wrote to memory of 1680	3776	WScript.exe	78
PID 3776 wrote to memory of 1680	3776	WScript.exe	78
PID 1680 wrote to memory of 1052	1680	wscript.exe	79
PID 1680 wrote to memory of 1052	1680	wscript.exe	79
PID 1052 wrote to memory of 4804	1052	cmd.exe	81
PID 1052 wrote to memory of 4804	1052	cmd.exe	81
PID 1680 wrote to memory of 1224	1680	wscript.exe	84
PID 1680 wrote to memory of 1224	1680	wscript.exe	84
PID 1680 wrote to memory of 2120	1680	wscript.exe	85
PID 1680 wrote to memory of 2120	1680	wscript.exe	85
PID 1680 wrote to memory of 976	1680	wscript.exe	87
PID 1680 wrote to memory of 976	1680	wscript.exe	87
PID 1680 wrote to memory of 2480	1680	wscript.exe	88
PID 1680 wrote to memory of 2480	1680	wscript.exe	88
PID 1680 wrote to memory of 248	1680	wscript.exe	89
PID 1680 wrote to memory of 248	1680	wscript.exe	89
PID 1680 wrote to memory of 1692	1680	wscript.exe	90
PID 1680 wrote to memory of 1692	1680	wscript.exe	90
PID 1680 wrote to memory of 1364	1680	wscript.exe	92
PID 1680 wrote to memory of 1364	1680	wscript.exe	92
PID 1680 wrote to memory of 3800	1680	wscript.exe	96
PID 1680 wrote to memory of 3800	1680	wscript.exe	96
PID 1680 wrote to memory of 4220	1680	wscript.exe	97
PID 1680 wrote to memory of 4220	1680	wscript.exe	97
PID 1680 wrote to memory of 3148	1680	wscript.exe	98
PID 1680 wrote to memory of 3148	1680	wscript.exe	98
PID 1680 wrote to memory of 2976	1680	wscript.exe	99
PID 1680 wrote to memory of 2976	1680	wscript.exe	99
PID 1680 wrote to memory of 1000	1680	wscript.exe	100
PID 1680 wrote to memory of 1000	1680	wscript.exe	100
PID 1680 wrote to memory of 572	1680	wscript.exe	101
PID 1680 wrote to memory of 572	1680	wscript.exe	101
PID 1680 wrote to memory of 2768	1680	wscript.exe	102
PID 1680 wrote to memory of 2768	1680	wscript.exe	102
PID 1680 wrote to memory of 4864	1680	wscript.exe	103
PID 1680 wrote to memory of 4864	1680	wscript.exe	103
PID 1680 wrote to memory of 5020	1680	wscript.exe	104
PID 1680 wrote to memory of 5020	1680	wscript.exe	104
PID 1680 wrote to memory of 2144	1680	wscript.exe	105
PID 1680 wrote to memory of 2144	1680	wscript.exe	105
PID 1680 wrote to memory of 2788	1680	wscript.exe	106
PID 1680 wrote to memory of 2788	1680	wscript.exe	106
PID 1680 wrote to memory of 5000	1680	wscript.exe	107
PID 1680 wrote to memory of 5000	1680	wscript.exe	107

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoChangeStartMenu = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe

flow	ioc
1	drive.google.com
3	drive.google.com

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads