dc8e56607a3db0ffb93fad7964d9f59e2f58a79fb56db066ce345f78273bbf63

Analysis

max time kernel
598s
max time network
474s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/05/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toomanyping.bat
Size 6KB
Sample260511-thrdbadz9x
SHA256 dc8e56607a3db0ffb93fad7964d9f59e2f58a79fb56db066ce345f78273bbf63
MD5 194d1f9ee39cacadb6f20975f1560df0
SHA1 1f08d2cff0ca34d03df5de1f3910d5f1f7c1fa69
SHA512 4274c1a993a7ec756d4b89046198a17e4adfb3d50b1da916561c129da239923def2e159701c07159b3faeedb93e731294cfc531a798665f0d9fa962bae1dd508
SSDEEP 96:QcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnb:b
TLSH
T183E1C2C71D5E70F4497C7968917837A6E92FE22F4E06A544440F3530241FE92F7B9AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2052	PING.EXE
2552	PING.EXE
5060	PING.EXE
2464	PING.EXE
5100	PING.EXE
5848	PING.EXE
3668	PING.EXE
3568	PING.EXE
1840	PING.EXE
3572	PING.EXE
5156	PING.EXE
5200	PING.EXE
4384	PING.EXE
1944	PING.EXE
3560	PING.EXE
1884	PING.EXE
5204	PING.EXE
2272	PING.EXE
3532	PING.EXE
3860	PING.EXE
6128	PING.EXE
6004	PING.EXE
1088	PING.EXE
3680	PING.EXE
1492	PING.EXE
4060	PING.EXE
2464	PING.EXE
5260	PING.EXE
5772	PING.EXE
2756	PING.EXE
1092	PING.EXE
5876	PING.EXE
6104	PING.EXE
4916	PING.EXE
4364	PING.EXE
2968	PING.EXE
3812	PING.EXE
5716	PING.EXE
5444	PING.EXE
1580	PING.EXE
3944	PING.EXE
5920	PING.EXE
4780	PING.EXE
1772	PING.EXE
912	PING.EXE
4732	PING.EXE
1396	PING.EXE
3960	PING.EXE
3240	PING.EXE
5828	PING.EXE
688	PING.EXE
812	PING.EXE
3240	PING.EXE
704	PING.EXE
3084	PING.EXE
3212	PING.EXE
4436	PING.EXE
2064	PING.EXE
2588	PING.EXE
5840	PING.EXE
2332	PING.EXE
372	PING.EXE
5480	PING.EXE
4332	PING.EXE

Delays execution with timeout.exe 11 IoCs

defense_evasion

pid	Process
6012	timeout.exe
2132	timeout.exe
3528	timeout.exe
2980	timeout.exe
2092	timeout.exe
3468	timeout.exe
4392	timeout.exe
4528	timeout.exe
3448	timeout.exe
4736	timeout.exe
2372	timeout.exe

Kills process with taskkill 48 IoCs

defense_evasion

pid	Process
5876	taskkill.exe
2248	taskkill.exe
6024	taskkill.exe
2284	taskkill.exe
4848	taskkill.exe
4580	taskkill.exe
3592	taskkill.exe
3492	taskkill.exe
1056	taskkill.exe
3172	taskkill.exe
6000	taskkill.exe
4360	taskkill.exe
2132	taskkill.exe
3412	taskkill.exe
1872	taskkill.exe
4560	taskkill.exe
4440	taskkill.exe
3756	taskkill.exe
3452	taskkill.exe
2168	taskkill.exe
5088	taskkill.exe
3976	taskkill.exe
5116	taskkill.exe
4304	taskkill.exe
5460	taskkill.exe
5988	taskkill.exe
3880	taskkill.exe
724	taskkill.exe
5492	taskkill.exe
3648	taskkill.exe
4812	taskkill.exe
5028	taskkill.exe
5804	taskkill.exe
4080	taskkill.exe
5112	taskkill.exe
4008	taskkill.exe
1552	taskkill.exe
640	taskkill.exe
4112	taskkill.exe
2944	taskkill.exe
636	taskkill.exe
4956	taskkill.exe
4636	taskkill.exe
5736	taskkill.exe
3944	taskkill.exe
2748	taskkill.exe
3300	taskkill.exe
4092	taskkill.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
1764	PING.EXE
564	PING.EXE
6004	PING.EXE
704	PING.EXE
5480	PING.EXE
1884	PING.EXE
5260	PING.EXE
5768	PING.EXE
4932	PING.EXE
2420	PING.EXE
2252	PING.EXE
3400	PING.EXE
1060	PING.EXE
5920	PING.EXE
3788	PING.EXE
2272	PING.EXE
812	PING.EXE
3680	PING.EXE
5744	PING.EXE
1944	PING.EXE
912	PING.EXE
5204	PING.EXE
2052	PING.EXE
2548	PING.EXE
5156	PING.EXE
5828	PING.EXE
4436	PING.EXE
2720	PING.EXE
3572	PING.EXE
1580	PING.EXE
1088	PING.EXE
3212	PING.EXE
4780	PING.EXE
5772	PING.EXE
5716	PING.EXE
6104	PING.EXE
5060	PING.EXE
1472	PING.EXE
4284	PING.EXE
3568	PING.EXE
4320	PING.EXE
2464	PING.EXE
4248	PING.EXE
2756	PING.EXE
5872	PING.EXE
3524	PING.EXE
4364	PING.EXE
1492	PING.EXE
1788	PING.EXE
1092	PING.EXE
4916	PING.EXE
2332	PING.EXE
3960	PING.EXE
4332	PING.EXE
4384	PING.EXE
2968	PING.EXE
3812	PING.EXE
764	PING.EXE
3668	PING.EXE
688	PING.EXE
2552	PING.EXE
2476	PING.EXE
2476	PING.EXE
2588	PING.EXE

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	taskkill.exe
Token: SeDebugPrivilege	3492	taskkill.exe
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeDebugPrivilege	5876	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	5988	taskkill.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	5804	taskkill.exe
Token: SeDebugPrivilege	3880	taskkill.exe
Token: SeDebugPrivilege	724	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	4080	taskkill.exe
Token: SeDebugPrivilege	5460	taskkill.exe
Token: SeDebugPrivilege	636	taskkill.exe
Token: SeDebugPrivilege	5736	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	5492	taskkill.exe
Token: SeDebugPrivilege	3944	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	3172	taskkill.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	3300	taskkill.exe
Token: SeDebugPrivilege	5112	taskkill.exe
Token: SeDebugPrivilege	4092	taskkill.exe
Token: SeDebugPrivilege	4812	taskkill.exe
Token: SeDebugPrivilege	4008	taskkill.exe
Token: SeDebugPrivilege	6000	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	4560	taskkill.exe
Token: SeDebugPrivilege	4440	taskkill.exe
Token: SeDebugPrivilege	4360	taskkill.exe
Token: SeDebugPrivilege	3756	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	2168	taskkill.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	4636	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2552	4532	cmd.exe	82
PID 4532 wrote to memory of 1396	4532	cmd.exe	87
PID 4532 wrote to memory of 4932	4532	cmd.exe	89
PID 4532 wrote to memory of 2420	4532	cmd.exe	91
PID 4532 wrote to memory of 5204	4532	cmd.exe	92
PID 4532 wrote to memory of 5060	4532	cmd.exe	93
PID 4532 wrote to memory of 5308	4532	cmd.exe	94
PID 4532 wrote to memory of 2476	4532	cmd.exe	95
PID 4532 wrote to memory of 3412	4532	cmd.exe	96
PID 4532 wrote to memory of 3492	4532	cmd.exe	97
PID 4532 wrote to memory of 3592	4532	cmd.exe	98
PID 4532 wrote to memory of 5876	4532	cmd.exe	99
PID 4532 wrote to memory of 6012	4532	cmd.exe	109
PID 4532 wrote to memory of 1472	4532	cmd.exe	110
PID 4532 wrote to memory of 2252	4532	cmd.exe	116
PID 4532 wrote to memory of 2464	4532	cmd.exe	118
PID 4532 wrote to memory of 2272	4532	cmd.exe	119
PID 4532 wrote to memory of 3788	4532	cmd.exe	120
PID 4532 wrote to memory of 5716	4532	cmd.exe	121
PID 4532 wrote to memory of 5100	4532	cmd.exe	122
PID 4532 wrote to memory of 688	4532	cmd.exe	124
PID 4532 wrote to memory of 2248	4532	cmd.exe	127
PID 4532 wrote to memory of 2944	4532	cmd.exe	128
PID 4532 wrote to memory of 6024	4532	cmd.exe	129
PID 4532 wrote to memory of 5988	4532	cmd.exe	130
PID 4532 wrote to memory of 2132	4532	cmd.exe	132
PID 4532 wrote to memory of 2064	4532	cmd.exe	139
PID 4532 wrote to memory of 812	4532	cmd.exe	140
PID 4532 wrote to memory of 4248	4532	cmd.exe	141
PID 4532 wrote to memory of 2052	4532	cmd.exe	144
PID 4532 wrote to memory of 3400	4532	cmd.exe	146
PID 4532 wrote to memory of 3316	4532	cmd.exe	148
PID 4532 wrote to memory of 3240	4532	cmd.exe	149
PID 4532 wrote to memory of 2756	4532	cmd.exe	150
PID 4532 wrote to memory of 3880	4532	cmd.exe	151
PID 4532 wrote to memory of 2284	4532	cmd.exe	152
PID 4532 wrote to memory of 5804	4532	cmd.exe	153
PID 4532 wrote to memory of 5028	4532	cmd.exe	154
PID 4532 wrote to memory of 3528	4532	cmd.exe	155
PID 4532 wrote to memory of 1092	4532	cmd.exe	163
PID 4532 wrote to memory of 5444	4532	cmd.exe	164
PID 4532 wrote to memory of 5768	4532	cmd.exe	165
PID 4532 wrote to memory of 3532	4532	cmd.exe	167
PID 4532 wrote to memory of 2548	4532	cmd.exe	168
PID 4532 wrote to memory of 3492	4532	cmd.exe	169
PID 4532 wrote to memory of 5876	4532	cmd.exe	170
PID 4532 wrote to memory of 5848	4532	cmd.exe	171
PID 4532 wrote to memory of 1872	4532	cmd.exe	172
PID 4532 wrote to memory of 4080	4532	cmd.exe	173
PID 4532 wrote to memory of 5460	4532	cmd.exe	175
PID 4532 wrote to memory of 724	4532	cmd.exe	177
PID 4532 wrote to memory of 3448	4532	cmd.exe	179
PID 4532 wrote to memory of 1764	4532	cmd.exe	187
PID 4532 wrote to memory of 2476	4532	cmd.exe	188
PID 4532 wrote to memory of 6104	4532	cmd.exe	190
PID 4532 wrote to memory of 5840	4532	cmd.exe	191
PID 4532 wrote to memory of 2588	4532	cmd.exe	192
PID 4532 wrote to memory of 1840	4532	cmd.exe	196
PID 4532 wrote to memory of 4916	4532	cmd.exe	197
PID 4532 wrote to memory of 5568	4532	cmd.exe	198
PID 4532 wrote to memory of 4848	4532	cmd.exe	199
PID 4532 wrote to memory of 4956	4532	cmd.exe	200
PID 4532 wrote to memory of 636	4532	cmd.exe	201
PID 4532 wrote to memory of 5736	4532	cmd.exe	202

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\toomanyping.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2552
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1396
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4932
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2420
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5204
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5060
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:5308
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5876
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6012
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1472
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2252
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2464
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2272
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3788
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5716
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5100
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:688
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6024
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2132
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2064
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:812
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4248
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2052
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3400
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:3316
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3240
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2756
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5804
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3528
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1092
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5444
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:5768
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3532
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2548
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:3492
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5876
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5848
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:724
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3448
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1764
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2476
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6104
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5840
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2588
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1840
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4916
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:5568
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5736
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2980
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2720
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2332
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6128
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:372
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:5872
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:764
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:564
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5492
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2092
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3668
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3572
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3960
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5156
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6004
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4284
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:704
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4736
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5200
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:4160
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1580
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4364
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:404
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3524
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5480
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3568
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3468
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4332
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:4484
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1492
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5828
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:4452
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1788
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:4892
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6000
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4008
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4392
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4384
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1088
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3944
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4732
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3084
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2968
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3680
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1060
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4528
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3812
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:5744
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1944
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2464
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5920
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4060
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3212
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4780
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3756
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2372
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3560
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1884
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1772
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4436
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5260
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:2280
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:912
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-5-0x000001E9F05C0000-0x000001E9F065E000-memory.dmp

Download

memory/2132-1-0x0000029BD7620000-0x0000029BD76BE000-memory.dmp

Download

memory/2372-10-0x000001FF8E4F0000-0x000001FF8E58E000-memory.dmp

Download

memory/2980-4-0x0000025860E30000-0x0000025860ECE000-memory.dmp

Download

memory/3448-3-0x0000012BA1CB0000-0x0000012BA1D4E000-memory.dmp

Download

memory/3468-7-0x0000028C422D0000-0x0000028C4236E000-memory.dmp

Download

memory/3528-2-0x00000143B43D0000-0x00000143B446E000-memory.dmp

Download

memory/4392-8-0x00000204E6310000-0x00000204E63AE000-memory.dmp

Download

memory/4528-9-0x00000259AC1E0000-0x00000259AC27E000-memory.dmp

Download

memory/4736-6-0x000001F4F7410000-0x000001F4F74AE000-memory.dmp

Download

memory/6012-0-0x000001A44FD60000-0x000001A44FDFE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads