856b8a4cd11f59a63c0f6af934cb1649a4d320d8a3802afaab5999e003a30d97

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
176.65.144.144_sample.exe
Size 1.9MB
Sample261017-ywtstaws6j
SHA256 856b8a4cd11f59a63c0f6af934cb1649a4d320d8a3802afaab5999e003a30d97
MD5 9b982414af9c639ecc4eae04d659862d
SHA1 2e73e03618900ef4f37157122eff5dfdc0c15d2f
SHA512 e8c701c37cad0de23576c3d30023941cacaaae4bb194548c750762bbbe071a30d057cd1e9bd1aae393c528cd872ab0a45def8a3d0441e427bee90f4f21b490e4
SSDEEP 24576:cRfqQ+FbnTwprZMo9wxGmUGJZ4bkFFJ8dtAGcMVTvHdOmdVIH06iy9FMsYX:coQ+VqrZMoob4bkFJ8oGrVBbIU6isvW
TLSH
T1F8956C03F69580FCC55EC1788347A632EA22BC8E092576EB27D09B253E76F915F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Provider 812 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\176.65.144.144_sample.exe"	176.65.144.144_sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Provider 651 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\176.65.144.144_sample.exe"	176.65.144.144_sample.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
4	api.ipify.org

Executes a command shell one-liner 1 TTPs 50 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2220	cmd.exe
4756	cmd.exe
1268	cmd.exe
5808	cmd.exe
3088	cmd.exe
3336	cmd.exe
2648	cmd.exe
2456	cmd.exe
3492	cmd.exe
1404	cmd.exe
4184	cmd.exe
1588	cmd.exe
2568	cmd.exe
5268	cmd.exe
1916	cmd.exe
1836	cmd.exe
4388	cmd.exe
768	cmd.exe
2260	cmd.exe
1872	cmd.exe
3524	cmd.exe
5800	cmd.exe
2916	cmd.exe
4872	cmd.exe
1348	cmd.exe
3004	cmd.exe
6012	cmd.exe
1864	cmd.exe
1604	cmd.exe
5996	cmd.exe
716	cmd.exe
5296	cmd.exe
5392	cmd.exe
5796	cmd.exe
4592	cmd.exe
4340	cmd.exe
1932	cmd.exe
2724	cmd.exe
5060	cmd.exe
2268	cmd.exe
5008	cmd.exe
2764	cmd.exe
2996	cmd.exe
3368	cmd.exe
4552	cmd.exe
3340	cmd.exe
4608	cmd.exe
1120	cmd.exe
1976	cmd.exe
3460	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	176.65.144.144_sample.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	176.65.144.144_sample.exe

Gathers network information 2 TTPs 50 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5828	ipconfig.exe
2784	ipconfig.exe
3892	ipconfig.exe
1928	ipconfig.exe
2124	ipconfig.exe
3528	ipconfig.exe
2112	ipconfig.exe
2628	ipconfig.exe
1240	ipconfig.exe
5984	ipconfig.exe
3440	ipconfig.exe
2596	ipconfig.exe
5324	ipconfig.exe
2900	ipconfig.exe
1220	ipconfig.exe
4084	ipconfig.exe
4092	ipconfig.exe
2384	ipconfig.exe
2872	ipconfig.exe
3324	ipconfig.exe
1100	ipconfig.exe
5792	ipconfig.exe
3632	ipconfig.exe
5676	ipconfig.exe
2012	ipconfig.exe
2472	ipconfig.exe
5376	ipconfig.exe
2344	ipconfig.exe
2660	ipconfig.exe
4276	ipconfig.exe
4980	ipconfig.exe
4296	ipconfig.exe
2112	ipconfig.exe
5960	ipconfig.exe
4136	ipconfig.exe
3772	ipconfig.exe
2492	ipconfig.exe
6040	ipconfig.exe
5636	ipconfig.exe
2696	ipconfig.exe
5448	ipconfig.exe
1860	ipconfig.exe
788	ipconfig.exe
3236	ipconfig.exe
2948	ipconfig.exe
2528	ipconfig.exe
5944	ipconfig.exe
1696	ipconfig.exe
5692	ipconfig.exe
4600	ipconfig.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1120	2552	176.65.144.144_sample.exe	91
PID 1120 wrote to memory of 2112	1120	cmd.exe	92
PID 2552 wrote to memory of 1916	2552	176.65.144.144_sample.exe	93
PID 1916 wrote to memory of 5376	1916	cmd.exe	94
PID 4456 wrote to memory of 5296	4456	176.65.144.144_sample.exe	97
PID 5296 wrote to memory of 2528	5296	cmd.exe	98
PID 4456 wrote to memory of 3524	4456	176.65.144.144_sample.exe	99
PID 3524 wrote to memory of 3440	3524	cmd.exe	100
PID 2552 wrote to memory of 5800	2552	176.65.144.144_sample.exe	101
PID 4456 wrote to memory of 6012	4456	176.65.144.144_sample.exe	102
PID 6012 wrote to memory of 2628	6012	cmd.exe	103
PID 5800 wrote to memory of 5828	5800	cmd.exe	104
PID 4456 wrote to memory of 1864	4456	176.65.144.144_sample.exe	105
PID 2552 wrote to memory of 1976	2552	176.65.144.144_sample.exe	106
PID 1976 wrote to memory of 6040	1976	cmd.exe	108
PID 1864 wrote to memory of 2872	1864	cmd.exe	107
PID 2552 wrote to memory of 2916	2552	176.65.144.144_sample.exe	109
PID 4456 wrote to memory of 5392	4456	176.65.144.144_sample.exe	110
PID 5392 wrote to memory of 2596	5392	cmd.exe	111
PID 2916 wrote to memory of 5944	2916	cmd.exe	112
PID 4456 wrote to memory of 2268	4456	176.65.144.144_sample.exe	113
PID 2552 wrote to memory of 3460	2552	176.65.144.144_sample.exe	114
PID 2268 wrote to memory of 5636	2268	cmd.exe	115
PID 3460 wrote to memory of 2696	3460	cmd.exe	116
PID 4456 wrote to memory of 1836	4456	176.65.144.144_sample.exe	118
PID 2552 wrote to memory of 4184	2552	176.65.144.144_sample.exe	119
PID 4184 wrote to memory of 1240	4184	cmd.exe	120
PID 1836 wrote to memory of 5324	1836	cmd.exe	121
PID 2552 wrote to memory of 5008	2552	176.65.144.144_sample.exe	123
PID 4456 wrote to memory of 4872	4456	176.65.144.144_sample.exe	122
PID 4872 wrote to memory of 5960	4872	cmd.exe	124
PID 5008 wrote to memory of 3324	5008	cmd.exe	125
PID 2552 wrote to memory of 1604	2552	176.65.144.144_sample.exe	127
PID 4456 wrote to memory of 2764	4456	176.65.144.144_sample.exe	126
PID 1604 wrote to memory of 1100	1604	cmd.exe	128
PID 2764 wrote to memory of 2344	2764	cmd.exe	129
PID 4456 wrote to memory of 5796	4456	176.65.144.144_sample.exe	131
PID 2552 wrote to memory of 4592	2552	176.65.144.144_sample.exe	130
PID 5796 wrote to memory of 2900	5796	cmd.exe	132
PID 4592 wrote to memory of 2784	4592	cmd.exe	133
PID 4456 wrote to memory of 5808	4456	176.65.144.144_sample.exe	134
PID 2552 wrote to memory of 1588	2552	176.65.144.144_sample.exe	135
PID 5808 wrote to memory of 2660	5808	cmd.exe	136
PID 1588 wrote to memory of 5792	1588	cmd.exe	137
PID 4456 wrote to memory of 1348	4456	176.65.144.144_sample.exe	138
PID 2552 wrote to memory of 4340	2552	176.65.144.144_sample.exe	139
PID 4340 wrote to memory of 1220	4340	cmd.exe	140
PID 1348 wrote to memory of 1696	1348	cmd.exe	141
PID 4456 wrote to memory of 1932	4456	176.65.144.144_sample.exe	142
PID 2552 wrote to memory of 2996	2552	176.65.144.144_sample.exe	143
PID 1932 wrote to memory of 3632	1932	cmd.exe	144
PID 2996 wrote to memory of 4084	2996	cmd.exe	145
PID 2552 wrote to memory of 3368	2552	176.65.144.144_sample.exe	147
PID 4456 wrote to memory of 2220	4456	176.65.144.144_sample.exe	146
PID 3368 wrote to memory of 5676	3368	cmd.exe	148
PID 2220 wrote to memory of 4092	2220	cmd.exe	149
PID 4456 wrote to memory of 2568	4456	176.65.144.144_sample.exe	150
PID 2552 wrote to memory of 2724	2552	176.65.144.144_sample.exe	151
PID 2724 wrote to memory of 3892	2724	cmd.exe	152
PID 2568 wrote to memory of 2384	2568	cmd.exe	153
PID 2552 wrote to memory of 5060	2552	176.65.144.144_sample.exe	154
PID 4456 wrote to memory of 4756	4456	176.65.144.144_sample.exe	155
PID 4756 wrote to memory of 1928	4756	cmd.exe	156
PID 5060 wrote to memory of 5448	5060	cmd.exe	157

C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
"C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2112
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5376
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5828
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6040
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5944
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2696
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1240
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3324
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1100
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2784
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5792
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1220
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4084
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5676
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3892
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5448
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4552
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4276
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3336
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1860
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1268
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2472
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4388
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3236
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:768
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2124
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3004
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2112
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3492
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3528
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1404
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5692
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1872
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3772

C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
C:\Users\Admin\AppData\Local\Temp\176.65.144.144_sample.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2528
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2628
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2872
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2596
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5636
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5324
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5960
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2344
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2900
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2660
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1696
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3632
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2384
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1928
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3088
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2012
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2648
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5984
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3340
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:788
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4608
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4980
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5996
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5268
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2456
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2948
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:716
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2260
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-6-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-12-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-2-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-24-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-4-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-22-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-8-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-14-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-26-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-20-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-10-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-18-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-0-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/2552-16-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-7-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-15-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-13-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-17-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-11-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-19-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-9-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-21-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-5-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-23-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-3-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-25-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-1-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

memory/4456-27-0x00007FF64D6A0000-0x00007FF64D886000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads