38489950659ccb62d430f2805bafa2ad5ae4677770900803a7803bab0a74ff4e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
176.65.144.144_sample.exe
Size 1.9MB
Sample261017-t4yphsaw7s
SHA256 38489950659ccb62d430f2805bafa2ad5ae4677770900803a7803bab0a74ff4e
MD5 a09445b8e49e52465126e96edf1b5a8d
SHA1 150991c0322724c77f53fe7f76ef654cbbaec0dc
SHA512 9c57b7d72590578502d0b5e0e75289d15cb597f7575e86a633e0285fdfe6caa810a09ad38ed05710732e1daaabd61dfb774f046456c66ec9cdfda8457505ec59
SSDEEP 24576:IRfqQKFbnTwprZMo9wxGmUGJZ4bkFFJ8dtAGcMVTvHdOmdVIH06iy9FMsYX:IoQKVqrZMoob4bkFJ8oGrVBbIU6isvW
TLSH
T196956D03F69580FCC55EC1788347A632EA22BC8E092576EB27D09B253E76F915F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security Update 853 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\176.65.144.144_sample.exe"	176.65.144.144_sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update 876 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\176.65.144.144_sample.exe"	176.65.144.144_sample.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
4	api.ipify.org
14	api.ipify.org

Executes a command shell one-liner 1 TTPs 50 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4620	cmd.exe
688	cmd.exe
5024	cmd.exe
5052	cmd.exe
3716	cmd.exe
4844	cmd.exe
3460	cmd.exe
2484	cmd.exe
4360	cmd.exe
2096	cmd.exe
4872	cmd.exe
5100	cmd.exe
1480	cmd.exe
3304	cmd.exe
2280	cmd.exe
2924	cmd.exe
1748	cmd.exe
3516	cmd.exe
3484	cmd.exe
4260	cmd.exe
1424	cmd.exe
3340	cmd.exe
4684	cmd.exe
4104	cmd.exe
3204	cmd.exe
4292	cmd.exe
2432	cmd.exe
368	cmd.exe
4204	cmd.exe
1940	cmd.exe
2616	cmd.exe
4440	cmd.exe
2804	cmd.exe
4048	cmd.exe
3004	cmd.exe
628	cmd.exe
4912	cmd.exe
4316	cmd.exe
1792	cmd.exe
892	cmd.exe
1264	cmd.exe
3120	cmd.exe
2436	cmd.exe
2500	cmd.exe
1696	cmd.exe
4680	cmd.exe
1304	cmd.exe
2976	cmd.exe
1708	cmd.exe
4636	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	176.65.144.144_sample.exe

Gathers network information 2 TTPs 50 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
728	ipconfig.exe
1180	ipconfig.exe
3688	ipconfig.exe
1060	ipconfig.exe
3464	ipconfig.exe
3268	ipconfig.exe
652	ipconfig.exe
3756	ipconfig.exe
4152	ipconfig.exe
4800	ipconfig.exe
3044	ipconfig.exe
2252	ipconfig.exe
4108	ipconfig.exe
1432	ipconfig.exe
3400	ipconfig.exe
2336	ipconfig.exe
3840	ipconfig.exe
2140	ipconfig.exe
2764	ipconfig.exe
3064	ipconfig.exe
1692	ipconfig.exe
2008	ipconfig.exe
4180	ipconfig.exe
4732	ipconfig.exe
4832	ipconfig.exe
932	ipconfig.exe
4512	ipconfig.exe
716	ipconfig.exe
1536	ipconfig.exe
4400	ipconfig.exe
4736	ipconfig.exe
4068	ipconfig.exe
2944	ipconfig.exe
2316	ipconfig.exe
936	ipconfig.exe
3780	ipconfig.exe
3876	ipconfig.exe
4288	ipconfig.exe
688	ipconfig.exe
3156	ipconfig.exe
4732	ipconfig.exe
400	ipconfig.exe
1932	ipconfig.exe
3080	ipconfig.exe
4836	ipconfig.exe
452	ipconfig.exe
4704	ipconfig.exe
2868	ipconfig.exe
3156	ipconfig.exe
4288	ipconfig.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2432	2300	176.65.144.144_sample.exe	87
PID 2432 wrote to memory of 728	2432	cmd.exe	88
PID 2300 wrote to memory of 5100	2300	176.65.144.144_sample.exe	90
PID 5100 wrote to memory of 3840	5100	cmd.exe	91
PID 3084 wrote to memory of 4260	3084	176.65.144.144_sample.exe	95
PID 4260 wrote to memory of 4288	4260	cmd.exe	96
PID 3084 wrote to memory of 1480	3084	176.65.144.144_sample.exe	97
PID 1480 wrote to memory of 4800	1480	cmd.exe	98
PID 2300 wrote to memory of 368	2300	176.65.144.144_sample.exe	103
PID 368 wrote to memory of 4832	368	cmd.exe	104
PID 3084 wrote to memory of 1424	3084	176.65.144.144_sample.exe	106
PID 1424 wrote to memory of 932	1424	cmd.exe	107
PID 2300 wrote to memory of 4204	2300	176.65.144.144_sample.exe	110
PID 4204 wrote to memory of 3044	4204	cmd.exe	111
PID 3084 wrote to memory of 3304	3084	176.65.144.144_sample.exe	112
PID 3304 wrote to memory of 4512	3304	cmd.exe	113
PID 2300 wrote to memory of 2280	2300	176.65.144.144_sample.exe	114
PID 2280 wrote to memory of 1932	2280	cmd.exe	115
PID 3084 wrote to memory of 4844	3084	176.65.144.144_sample.exe	116
PID 4844 wrote to memory of 688	4844	cmd.exe	117
PID 2300 wrote to memory of 1940	2300	176.65.144.144_sample.exe	118
PID 1940 wrote to memory of 3080	1940	cmd.exe	119
PID 3084 wrote to memory of 2616	3084	176.65.144.144_sample.exe	120
PID 2616 wrote to memory of 4836	2616	cmd.exe	121
PID 2300 wrote to memory of 4440	2300	176.65.144.144_sample.exe	123
PID 4440 wrote to memory of 2140	4440	cmd.exe	124
PID 3084 wrote to memory of 2804	3084	176.65.144.144_sample.exe	126
PID 2804 wrote to memory of 3156	2804	cmd.exe	127
PID 2300 wrote to memory of 2924	2300	176.65.144.144_sample.exe	128
PID 2924 wrote to memory of 4736	2924	cmd.exe	129
PID 3084 wrote to memory of 2500	3084	176.65.144.144_sample.exe	130
PID 2500 wrote to memory of 2252	2500	cmd.exe	131
PID 2300 wrote to memory of 1748	2300	176.65.144.144_sample.exe	132
PID 1748 wrote to memory of 4108	1748	cmd.exe	133
PID 3084 wrote to memory of 1792	3084	176.65.144.144_sample.exe	134
PID 1792 wrote to memory of 1432	1792	cmd.exe	135
PID 2300 wrote to memory of 3516	2300	176.65.144.144_sample.exe	136
PID 3516 wrote to memory of 4732	3516	cmd.exe	137
PID 3084 wrote to memory of 2976	3084	176.65.144.144_sample.exe	138
PID 2976 wrote to memory of 452	2976	cmd.exe	139
PID 2300 wrote to memory of 1696	2300	176.65.144.144_sample.exe	140
PID 1696 wrote to memory of 1180	1696	cmd.exe	141
PID 3084 wrote to memory of 3460	3084	176.65.144.144_sample.exe	142
PID 3460 wrote to memory of 716	3460	cmd.exe	143
PID 2300 wrote to memory of 3484	2300	176.65.144.144_sample.exe	144
PID 3484 wrote to memory of 4704	3484	cmd.exe	145
PID 3084 wrote to memory of 4048	3084	176.65.144.144_sample.exe	146
PID 4048 wrote to memory of 3876	4048	cmd.exe	147
PID 2300 wrote to memory of 1708	2300	176.65.144.144_sample.exe	148
PID 1708 wrote to memory of 4068	1708	cmd.exe	149
PID 3084 wrote to memory of 3004	3084	176.65.144.144_sample.exe	150
PID 3004 wrote to memory of 4152	3004	cmd.exe	151
PID 2300 wrote to memory of 3340	2300	176.65.144.144_sample.exe	152
PID 3340 wrote to memory of 4288	3340	cmd.exe	153
PID 3084 wrote to memory of 4636	3084	176.65.144.144_sample.exe	154
PID 4636 wrote to memory of 1536	4636	cmd.exe	155
PID 2300 wrote to memory of 892	2300	176.65.144.144_sample.exe	156
PID 892 wrote to memory of 2944	892	cmd.exe	157
PID 3084 wrote to memory of 628	3084	176.65.144.144_sample.exe	158
PID 628 wrote to memory of 2764	628	cmd.exe	159
PID 2300 wrote to memory of 2484	2300	176.65.144.144_sample.exe	160
PID 2484 wrote to memory of 3688	2484	cmd.exe	161
PID 3084 wrote to memory of 4360	3084	176.65.144.144_sample.exe	162
PID 4360 wrote to memory of 3064	4360	cmd.exe	163

C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
"C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:728
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3840
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4832
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3044
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1932
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3080
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2140
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4736
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4108
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4732
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1180
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4704
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4068
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4288
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2944
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3688
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4684
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1060
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4104
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3464
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4680
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2868
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1264
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1692
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:652
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3204
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2336
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2436
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3756
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5024
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:400
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5052
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4180

C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4288
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4800
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:932
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4512
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:688
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4836
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3156
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2252
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1432
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:452
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:716
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3876
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4152
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1536
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2764
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3064
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4620
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2316
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2096
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3268
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:688
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:936
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4912
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4400
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3120
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1304
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3156
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4292
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3780
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4872
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2008
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3716
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-6-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-12-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-2-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-24-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-4-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-22-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-8-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-14-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-26-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-20-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-10-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-18-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-0-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/2300-16-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-7-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-15-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-13-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-17-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-11-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-19-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-9-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-21-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-5-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-23-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-3-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-25-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-1-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

memory/3084-27-0x00007FF642B70000-0x00007FF642D56000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads