38489950659ccb62d430f2805bafa2ad5ae4677770900803a7803bab0a74ff4e

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
176.65.144.144_sample.exe
Size 1.9MB
Sample261017-t4yphsaw7s
SHA256 38489950659ccb62d430f2805bafa2ad5ae4677770900803a7803bab0a74ff4e
MD5 a09445b8e49e52465126e96edf1b5a8d
SHA1 150991c0322724c77f53fe7f76ef654cbbaec0dc
SHA512 9c57b7d72590578502d0b5e0e75289d15cb597f7575e86a633e0285fdfe6caa810a09ad38ed05710732e1daaabd61dfb774f046456c66ec9cdfda8457505ec59
SSDEEP 24576:IRfqQKFbnTwprZMo9wxGmUGJZ4bkFFJ8dtAGcMVTvHdOmdVIH06iy9FMsYX:IoQKVqrZMoob4bkFJ8oGrVBbIU6isvW
TLSH
T196956D03F69580FCC55EC1788347A632EA22BC8E092576EB27D09B253E76F915F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Update 861 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\176.65.144.144_sample.exe"	176.65.144.144_sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Monitor 724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\176.65.144.144_sample.exe"	176.65.144.144_sample.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
6	api.ipify.org

Executes a command shell one-liner 1 TTPs 50 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5292	cmd.exe
5916	cmd.exe
6064	cmd.exe
5212	cmd.exe
4800	cmd.exe
1524	cmd.exe
2560	cmd.exe
3296	cmd.exe
5004	cmd.exe
5864	cmd.exe
4248	cmd.exe
792	cmd.exe
4852	cmd.exe
3372	cmd.exe
4120	cmd.exe
1044	cmd.exe
3392	cmd.exe
988	cmd.exe
2760	cmd.exe
3344	cmd.exe
3916	cmd.exe
1812	cmd.exe
1460	cmd.exe
1292	cmd.exe
3376	cmd.exe
4680	cmd.exe
480	cmd.exe
4768	cmd.exe
5372	cmd.exe
5132	cmd.exe
1464	cmd.exe
1284	cmd.exe
4416	cmd.exe
244	cmd.exe
5364	cmd.exe
5424	cmd.exe
3056	cmd.exe
6060	cmd.exe
2456	cmd.exe
2248	cmd.exe
2096	cmd.exe
2028	cmd.exe
2852	cmd.exe
1112	cmd.exe
6024	cmd.exe
2992	cmd.exe
3720	cmd.exe
3224	cmd.exe
1676	cmd.exe
5300	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	176.65.144.144_sample.exe

Gathers network information 2 TTPs 50 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3016	ipconfig.exe
2432	ipconfig.exe
2596	ipconfig.exe
3620	ipconfig.exe
2912	ipconfig.exe
3624	ipconfig.exe
4348	ipconfig.exe
2344	ipconfig.exe
1968	ipconfig.exe
4608	ipconfig.exe
1724	ipconfig.exe
1672	ipconfig.exe
5996	ipconfig.exe
1640	ipconfig.exe
4484	ipconfig.exe
5592	ipconfig.exe
3728	ipconfig.exe
2060	ipconfig.exe
5740	ipconfig.exe
3988	ipconfig.exe
4976	ipconfig.exe
5068	ipconfig.exe
4180	ipconfig.exe
3164	ipconfig.exe
2112	ipconfig.exe
5520	ipconfig.exe
2088	ipconfig.exe
3220	ipconfig.exe
5368	ipconfig.exe
4332	ipconfig.exe
1480	ipconfig.exe
2004	ipconfig.exe
1088	ipconfig.exe
4012	ipconfig.exe
5016	ipconfig.exe
1512	ipconfig.exe
2116	ipconfig.exe
3028	ipconfig.exe
4476	ipconfig.exe
2912	ipconfig.exe
3756	ipconfig.exe
908	ipconfig.exe
5680	ipconfig.exe
5380	ipconfig.exe
756	ipconfig.exe
2808	ipconfig.exe
3880	ipconfig.exe
1572	ipconfig.exe
3552	ipconfig.exe
5456	ipconfig.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 124 wrote to memory of 2456	124	176.65.144.144_sample.exe	88
PID 2456 wrote to memory of 3164	2456	cmd.exe	89
PID 124 wrote to memory of 988	124	176.65.144.144_sample.exe	91
PID 988 wrote to memory of 2004	988	cmd.exe	92
PID 5964 wrote to memory of 4248	5964	176.65.144.144_sample.exe	95
PID 4248 wrote to memory of 4476	4248	cmd.exe	96
PID 5964 wrote to memory of 4680	5964	176.65.144.144_sample.exe	97
PID 4680 wrote to memory of 2808	4680	cmd.exe	98
PID 124 wrote to memory of 4416	124	176.65.144.144_sample.exe	100
PID 5964 wrote to memory of 244	5964	176.65.144.144_sample.exe	99
PID 244 wrote to memory of 2912	244	cmd.exe	102
PID 4416 wrote to memory of 3880	4416	cmd.exe	101
PID 5964 wrote to memory of 480	5964	176.65.144.144_sample.exe	104
PID 124 wrote to memory of 2760	124	176.65.144.144_sample.exe	103
PID 480 wrote to memory of 1672	480	cmd.exe	105
PID 2760 wrote to memory of 4348	2760	cmd.exe	106
PID 5964 wrote to memory of 2992	5964	176.65.144.144_sample.exe	107
PID 124 wrote to memory of 2248	124	176.65.144.144_sample.exe	108
PID 2248 wrote to memory of 5996	2248	cmd.exe	109
PID 2992 wrote to memory of 1088	2992	cmd.exe	110
PID 5964 wrote to memory of 2096	5964	176.65.144.144_sample.exe	111
PID 124 wrote to memory of 5292	124	176.65.144.144_sample.exe	112
PID 5292 wrote to memory of 1572	5292	cmd.exe	113
PID 2096 wrote to memory of 2344	2096	cmd.exe	114
PID 124 wrote to memory of 3720	124	176.65.144.144_sample.exe	116
PID 5964 wrote to memory of 2028	5964	176.65.144.144_sample.exe	117
PID 3720 wrote to memory of 3728	3720	cmd.exe	118
PID 2028 wrote to memory of 1480	2028	cmd.exe	119
PID 124 wrote to memory of 3344	124	176.65.144.144_sample.exe	120
PID 5964 wrote to memory of 792	5964	176.65.144.144_sample.exe	121
PID 792 wrote to memory of 3552	792	cmd.exe	123
PID 3344 wrote to memory of 5456	3344	cmd.exe	122
PID 124 wrote to memory of 3224	124	176.65.144.144_sample.exe	124
PID 5964 wrote to memory of 3916	5964	176.65.144.144_sample.exe	125
PID 3224 wrote to memory of 4012	3224	cmd.exe	126
PID 3916 wrote to memory of 1968	3916	cmd.exe	127
PID 5964 wrote to memory of 2560	5964	176.65.144.144_sample.exe	128
PID 124 wrote to memory of 4768	124	176.65.144.144_sample.exe	129
PID 2560 wrote to memory of 5016	2560	cmd.exe	130
PID 4768 wrote to memory of 2060	4768	cmd.exe	131
PID 5964 wrote to memory of 2852	5964	176.65.144.144_sample.exe	132
PID 124 wrote to memory of 4852	124	176.65.144.144_sample.exe	133
PID 2852 wrote to memory of 3756	2852	cmd.exe	134
PID 4852 wrote to memory of 2112	4852	cmd.exe	135
PID 124 wrote to memory of 5916	124	176.65.144.144_sample.exe	136
PID 5964 wrote to memory of 1676	5964	176.65.144.144_sample.exe	137
PID 5916 wrote to memory of 3016	5916	cmd.exe	138
PID 1676 wrote to memory of 2432	1676	cmd.exe	139
PID 5964 wrote to memory of 5864	5964	176.65.144.144_sample.exe	140
PID 124 wrote to memory of 5364	124	176.65.144.144_sample.exe	141
PID 5864 wrote to memory of 5740	5864	cmd.exe	142
PID 5364 wrote to memory of 908	5364	cmd.exe	143
PID 5964 wrote to memory of 6064	5964	176.65.144.144_sample.exe	145
PID 124 wrote to memory of 5212	124	176.65.144.144_sample.exe	144
PID 5212 wrote to memory of 5592	5212	cmd.exe	146
PID 6064 wrote to memory of 5520	6064	cmd.exe	147
PID 5964 wrote to memory of 3372	5964	176.65.144.144_sample.exe	148
PID 124 wrote to memory of 5424	124	176.65.144.144_sample.exe	149
PID 5424 wrote to memory of 1640	5424	cmd.exe	150
PID 3372 wrote to memory of 1512	3372	cmd.exe	151
PID 5964 wrote to memory of 1460	5964	176.65.144.144_sample.exe	152
PID 124 wrote to memory of 1812	124	176.65.144.144_sample.exe	153
PID 1812 wrote to memory of 2088	1812	cmd.exe	154
PID 1460 wrote to memory of 2116	1460	cmd.exe	155

C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
"C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:124
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3164
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2004
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3880
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5996
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5292
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1572
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3728
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5456
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4012
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2060
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2112
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3016
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:908
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5592
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1640
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2088
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3056
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3988
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3296
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4608
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4120
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3220
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5004
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4484
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1044
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5380
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:6060
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:756
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:6024
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5068
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1464
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1524
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3624

C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4476
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2808
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2912
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1672
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1088
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2344
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1480
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3552
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1968
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5016
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3756
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5740
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5520
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1512
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2116
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1292
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2596
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1112
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5680
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5372
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3028
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4800
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5368
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3376
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5300
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1724
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3392
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4976
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5132
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2912
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1284
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/124-6-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-12-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-2-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-24-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-4-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-22-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-8-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-14-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-26-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-20-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-10-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-18-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-0-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/124-16-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-7-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-15-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-13-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-17-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-11-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-19-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-9-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-21-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-5-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-23-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-3-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-25-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-1-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

memory/5964-27-0x00007FF65A300000-0x00007FF65A4E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads