1c55c64f9204a12e8f0e79a4fd9a67b1d989d854f80f1ae6d0f56d07820855b4

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Midnight.bat
Size 142B
Sample261003-wal5qstdre
SHA256 1c55c64f9204a12e8f0e79a4fd9a67b1d989d854f80f1ae6d0f56d07820855b4
MD5 09f51ee0732bb350b2efb194366cd52e
SHA1 7eee112fa9e50f0cbf0c7947abc8789a15e36ec7
SHA512 d411d9aa30bfd6890a9b20e725f30712dd32393b450c8cdf01262357825aba181f4d9e7f8c20ef044ffcc043d0817489e530d78359a62bbab066f0b5c474e05e
TLSH
T13FC02B0B6C0608F7D83C2885D6B084403B0608204389DF10F68954C3A14F9C4234083D
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3468	cmd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3804	ipconfig.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4752	dwm.exe
Token: SeChangeNotifyPrivilege	4752	dwm.exe
Token: 33	4752	dwm.exe
Token: SeIncBasePriorityPrivilege	4752	dwm.exe
Token: SeShutdownPrivilege	4752	dwm.exe
Token: SeCreatePagefilePrivilege	4752	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 2872	3468	cmd.exe	87
PID 3468 wrote to memory of 3804	3468	cmd.exe	89
PID 3468 wrote to memory of 3524	3468	cmd.exe	91
PID 3468 wrote to memory of 4488	3468	cmd.exe	93
PID 3468 wrote to memory of 4368	3468	cmd.exe	96
PID 3468 wrote to memory of 1488	3468	cmd.exe	97
PID 3468 wrote to memory of 4028	3468	cmd.exe	99
PID 3468 wrote to memory of 5052	3468	cmd.exe	101
PID 3468 wrote to memory of 4932	3468	cmd.exe	103
PID 3468 wrote to memory of 4504	3468	cmd.exe	105
PID 3468 wrote to memory of 3868	3468	cmd.exe	106
PID 3468 wrote to memory of 1832	3468	cmd.exe	109
PID 3468 wrote to memory of 1172	3468	cmd.exe	110
PID 3468 wrote to memory of 2396	3468	cmd.exe	112
PID 3468 wrote to memory of 1728	3468	cmd.exe	113
PID 3468 wrote to memory of 5116	3468	cmd.exe	114
PID 3468 wrote to memory of 4628	3468	cmd.exe	117
PID 3468 wrote to memory of 308	3468	cmd.exe	121
PID 3468 wrote to memory of 220	3468	cmd.exe	122
PID 3468 wrote to memory of 1828	3468	cmd.exe	123
PID 3468 wrote to memory of 2588	3468	cmd.exe	125
PID 3468 wrote to memory of 4924	3468	cmd.exe	128
PID 3468 wrote to memory of 2096	3468	cmd.exe	129
PID 3468 wrote to memory of 3276	3468	cmd.exe	131
PID 3468 wrote to memory of 4896	3468	cmd.exe	134
PID 3468 wrote to memory of 2820	3468	cmd.exe	137
PID 3468 wrote to memory of 3368	3468	cmd.exe	139
PID 3468 wrote to memory of 2444	3468	cmd.exe	141
PID 3468 wrote to memory of 688	3468	cmd.exe	143
PID 3468 wrote to memory of 4812	3468	cmd.exe	145
PID 3468 wrote to memory of 2364	3468	cmd.exe	146
PID 3468 wrote to memory of 2412	3468	cmd.exe	147
PID 3468 wrote to memory of 4208	3468	cmd.exe	149
PID 3468 wrote to memory of 4200	3468	cmd.exe	152
PID 3468 wrote to memory of 3228	3468	cmd.exe	153
PID 3468 wrote to memory of 3456	3468	cmd.exe	156
PID 3468 wrote to memory of 4788	3468	cmd.exe	158
PID 3468 wrote to memory of 4928	3468	cmd.exe	159
PID 3468 wrote to memory of 1608	3468	cmd.exe	160
PID 3468 wrote to memory of 2748	3468	cmd.exe	161
PID 3468 wrote to memory of 4760	3468	cmd.exe	164
PID 3468 wrote to memory of 3188	3468	cmd.exe	167
PID 3468 wrote to memory of 4704	3468	cmd.exe	169
PID 3468 wrote to memory of 696	3468	cmd.exe	170
PID 3468 wrote to memory of 4384	3468	cmd.exe	172
PID 3468 wrote to memory of 1148	3468	cmd.exe	174
PID 3468 wrote to memory of 3804	3468	cmd.exe	175
PID 3468 wrote to memory of 3760	3468	cmd.exe	178
PID 3468 wrote to memory of 2500	3468	cmd.exe	180
PID 3468 wrote to memory of 972	3468	cmd.exe	181
PID 3468 wrote to memory of 2956	3468	cmd.exe	184
PID 3468 wrote to memory of 5312	3468	cmd.exe	189
PID 3468 wrote to memory of 5328	3468	cmd.exe	191
PID 3468 wrote to memory of 5344	3468	cmd.exe	192
PID 3468 wrote to memory of 5364	3468	cmd.exe	194
PID 3468 wrote to memory of 5380	3468	cmd.exe	195
PID 3468 wrote to memory of 5416	3468	cmd.exe	198
PID 3468 wrote to memory of 5448	3468	cmd.exe	200
PID 3468 wrote to memory of 5524	3468	cmd.exe	203
PID 3468 wrote to memory of 5912	3468	cmd.exe	205
PID 3468 wrote to memory of 5940	3468	cmd.exe	207
PID 3468 wrote to memory of 5960	3468	cmd.exe	209
PID 3468 wrote to memory of 6036	3468	cmd.exe	211
PID 3468 wrote to memory of 6064	3468	cmd.exe	213

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Midnight.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\system32\help.exe
  help
  2⤵
  PID:2872
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:3804
- C:\Windows\system32\help.exe
  help
  2⤵
  PID:3524
- C:\Windows\system32\help.exe
  help
  2⤵
  PID:4488
- C:\Windows\system32\msg.exe
  msg * SZCZOCH
  2⤵
  PID:4368
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1488
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4028
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5052
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4932
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4504
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3868
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1172
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2396
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1728
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5116
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4628
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:308
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:220
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1828
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2588
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4924
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3276
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4896
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2820
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3368
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2444
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:688
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4812
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2364
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2412
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4200
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3228
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3456
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4788
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1608
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2748
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4760
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3188
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4704
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4384
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1148
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3804
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3760
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:972
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2956
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5344
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5364
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5416
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5448
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5940
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6036
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6064
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6088
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6108
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6116
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3756
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6244
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6324
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6332
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6352
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6396
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6436
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6476
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6608
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6768
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6796
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6804
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6812
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6880
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6904
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6940
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6976
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7004
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7032
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7244
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7280
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7296
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7316
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7336
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7364
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7396
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7428
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7496
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7728
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7936
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7976
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8024
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8080
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8104
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8112
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8120
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8128
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8152
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8160
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8168
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8184
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7536
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7504
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7660
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7336
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7676
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6940
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7196
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6664
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6588
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7948
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6264
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7348
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7576
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8220
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8256
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8296
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8332
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8348
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8356
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8404
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8584
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9248
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9268
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9280
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9296
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9320
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9372
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9412
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9480
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9552
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9588
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9612
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9636
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9676
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9708
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9728
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9768
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9812
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9892
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9920
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9932
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9948
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9964
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9988
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10308
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10600
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10632
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10648
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10676
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10732
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10772
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10796
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10824
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10852
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10872
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11100
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11116
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11140
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11148
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11156
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11168
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11184
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11192
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11220
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11236
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11244
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11256
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10612
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10668
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10764
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11316
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11428
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11456
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11496
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11552
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11584
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11596
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11632
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11652
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11696
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11720
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11760
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11800
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11836
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11860
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11308
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12836

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3468-0-0x00007FF681090000-0x00007FF6810F7000-memory.dmp

Download

memory/4788-1-0x00007FF681090000-0x00007FF6810F7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads