72dcf3b5d7cd9832908d30bc412ada04e8ed3124e66494d14c6f0714e44dee22

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72dcf3b5d7cd9832.bin.exe
Size 1.9MB
Sample261019-btnsfswv2n
SHA256 72dcf3b5d7cd9832908d30bc412ada04e8ed3124e66494d14c6f0714e44dee22
MD5 99020755659ea520b8b2c3be32433e39
SHA1 16ebd4e325591813194289009c0ee0a2f94e43ea
SHA512 f85d45a055886069347de588feb99d44e59f83839b8ce304462293cb61c3a4f9128090014b39cec07167786819900bfdda1422cdd6869e24cc19b297785b5d12
SSDEEP 24576:5RfqQSFbnTwprZMo9wxGmUGJZ4bkFFJ8dtAGcMVTvHdOmdVIH06iy9FMsYX:5oQSVqrZMoob4bkFJ8oGrVBbIU6isvW
TLSH
T1B9956D03F69580FCC55EC1788347A632EA22BC8E092576EB27D09B253E76F915F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Update 609 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\72dcf3b5d7cd9832.bin.exe"	72dcf3b5d7cd9832.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Update 657 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\72dcf3b5d7cd9832.bin.exe"	72dcf3b5d7cd9832.bin.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
4	api.ipify.org

Executes a command shell one-liner 1 TTPs 50 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4104	cmd.exe
2020	cmd.exe
1960	cmd.exe
580	cmd.exe
1708	cmd.exe
5332	cmd.exe
4928	cmd.exe
3436	cmd.exe
5844	cmd.exe
4488	cmd.exe
3848	cmd.exe
3296	cmd.exe
5668	cmd.exe
1164	cmd.exe
5064	cmd.exe
3184	cmd.exe
3520	cmd.exe
4812	cmd.exe
800	cmd.exe
2976	cmd.exe
5740	cmd.exe
244	cmd.exe
2516	cmd.exe
3304	cmd.exe
2336	cmd.exe
3312	cmd.exe
2444	cmd.exe
1088	cmd.exe
3180	cmd.exe
4072	cmd.exe
4308	cmd.exe
2768	cmd.exe
4164	cmd.exe
796	cmd.exe
4144	cmd.exe
5832	cmd.exe
3284	cmd.exe
4844	cmd.exe
5084	cmd.exe
4304	cmd.exe
3776	cmd.exe
2676	cmd.exe
2732	cmd.exe
2800	cmd.exe
1788	cmd.exe
5404	cmd.exe
2244	cmd.exe
2812	cmd.exe
700	cmd.exe
4916	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	72dcf3b5d7cd9832.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	72dcf3b5d7cd9832.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	72dcf3b5d7cd9832.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	72dcf3b5d7cd9832.bin.exe

Gathers network information 2 TTPs 50 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1268	ipconfig.exe
5252	ipconfig.exe
5616	ipconfig.exe
2388	ipconfig.exe
5460	ipconfig.exe
624	ipconfig.exe
5884	ipconfig.exe
1360	ipconfig.exe
5060	ipconfig.exe
4220	ipconfig.exe
1148	ipconfig.exe
2928	ipconfig.exe
468	ipconfig.exe
3692	ipconfig.exe
4424	ipconfig.exe
2836	ipconfig.exe
4752	ipconfig.exe
2024	ipconfig.exe
4528	ipconfig.exe
4712	ipconfig.exe
3372	ipconfig.exe
1984	ipconfig.exe
268	ipconfig.exe
3492	ipconfig.exe
1824	ipconfig.exe
4488	ipconfig.exe
3084	ipconfig.exe
6036	ipconfig.exe
2836	ipconfig.exe
5508	ipconfig.exe
3472	ipconfig.exe
2684	ipconfig.exe
5588	ipconfig.exe
5872	ipconfig.exe
4828	ipconfig.exe
4668	ipconfig.exe
4676	ipconfig.exe
3748	ipconfig.exe
1564	ipconfig.exe
6112	ipconfig.exe
5380	ipconfig.exe
5544	ipconfig.exe
1480	ipconfig.exe
4864	ipconfig.exe
5896	ipconfig.exe
1656	ipconfig.exe
2880	ipconfig.exe
3804	ipconfig.exe
4340	ipconfig.exe
2364	ipconfig.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 3284	3904	72dcf3b5d7cd9832.bin.exe	92
PID 3284 wrote to memory of 1148	3284	cmd.exe	93
PID 3904 wrote to memory of 4844	3904	72dcf3b5d7cd9832.bin.exe	94
PID 4844 wrote to memory of 2364	4844	cmd.exe	95
PID 2536 wrote to memory of 5084	2536	72dcf3b5d7cd9832.bin.exe	98
PID 5084 wrote to memory of 2928	5084	cmd.exe	99
PID 2536 wrote to memory of 4304	2536	72dcf3b5d7cd9832.bin.exe	100
PID 4304 wrote to memory of 3492	4304	cmd.exe	101
PID 2536 wrote to memory of 4812	2536	72dcf3b5d7cd9832.bin.exe	102
PID 3904 wrote to memory of 3180	3904	72dcf3b5d7cd9832.bin.exe	103
PID 4812 wrote to memory of 3472	4812	cmd.exe	104
PID 3180 wrote to memory of 5508	3180	cmd.exe	105
PID 2536 wrote to memory of 2516	2536	72dcf3b5d7cd9832.bin.exe	107
PID 3904 wrote to memory of 5404	3904	72dcf3b5d7cd9832.bin.exe	108
PID 5404 wrote to memory of 1824	5404	cmd.exe	109
PID 2516 wrote to memory of 2684	2516	cmd.exe	110
PID 3904 wrote to memory of 796	3904	72dcf3b5d7cd9832.bin.exe	111
PID 2536 wrote to memory of 3304	2536	72dcf3b5d7cd9832.bin.exe	112
PID 796 wrote to memory of 468	796	cmd.exe	113
PID 3304 wrote to memory of 2836	3304	cmd.exe	114
PID 3904 wrote to memory of 800	3904	72dcf3b5d7cd9832.bin.exe	115
PID 2536 wrote to memory of 1960	2536	72dcf3b5d7cd9832.bin.exe	116
PID 800 wrote to memory of 4676	800	cmd.exe	117
PID 1960 wrote to memory of 4488	1960	cmd.exe	118
PID 3904 wrote to memory of 2244	3904	72dcf3b5d7cd9832.bin.exe	120
PID 2536 wrote to memory of 2336	2536	72dcf3b5d7cd9832.bin.exe	121
PID 2244 wrote to memory of 5884	2244	cmd.exe	122
PID 2336 wrote to memory of 4864	2336	cmd.exe	123
PID 2536 wrote to memory of 3776	2536	72dcf3b5d7cd9832.bin.exe	124
PID 3904 wrote to memory of 2676	3904	72dcf3b5d7cd9832.bin.exe	125
PID 3776 wrote to memory of 5896	3776	cmd.exe	127
PID 2676 wrote to memory of 3692	2676	cmd.exe	126
PID 3904 wrote to memory of 3848	3904	72dcf3b5d7cd9832.bin.exe	128
PID 2536 wrote to memory of 4144	2536	72dcf3b5d7cd9832.bin.exe	129
PID 3848 wrote to memory of 4424	3848	cmd.exe	130
PID 4144 wrote to memory of 1656	4144	cmd.exe	131
PID 2536 wrote to memory of 4072	2536	72dcf3b5d7cd9832.bin.exe	132
PID 3904 wrote to memory of 5832	3904	72dcf3b5d7cd9832.bin.exe	133
PID 4072 wrote to memory of 3084	4072	cmd.exe	134
PID 5832 wrote to memory of 1360	5832	cmd.exe	135
PID 3904 wrote to memory of 2732	3904	72dcf3b5d7cd9832.bin.exe	136
PID 2536 wrote to memory of 3296	2536	72dcf3b5d7cd9832.bin.exe	137
PID 2732 wrote to memory of 1268	2732	cmd.exe	138
PID 3296 wrote to memory of 3748	3296	cmd.exe	139
PID 2536 wrote to memory of 580	2536	72dcf3b5d7cd9832.bin.exe	141
PID 3904 wrote to memory of 2976	3904	72dcf3b5d7cd9832.bin.exe	140
PID 580 wrote to memory of 5588	580	cmd.exe	142
PID 2976 wrote to memory of 6036	2976	cmd.exe	143
PID 2536 wrote to memory of 1708	2536	72dcf3b5d7cd9832.bin.exe	144
PID 3904 wrote to memory of 2800	3904	72dcf3b5d7cd9832.bin.exe	145
PID 1708 wrote to memory of 5252	1708	cmd.exe	146
PID 2800 wrote to memory of 2880	2800	cmd.exe	147
PID 3904 wrote to memory of 5668	3904	72dcf3b5d7cd9832.bin.exe	149
PID 2536 wrote to memory of 1788	2536	72dcf3b5d7cd9832.bin.exe	148
PID 5668 wrote to memory of 4752	5668	cmd.exe	150
PID 1788 wrote to memory of 2024	1788	cmd.exe	151
PID 2536 wrote to memory of 5740	2536	72dcf3b5d7cd9832.bin.exe	152
PID 3904 wrote to memory of 3312	3904	72dcf3b5d7cd9832.bin.exe	153
PID 5740 wrote to memory of 3804	5740	cmd.exe	155
PID 3312 wrote to memory of 1564	3312	cmd.exe	154
PID 3904 wrote to memory of 5332	3904	72dcf3b5d7cd9832.bin.exe	157
PID 2536 wrote to memory of 1164	2536	72dcf3b5d7cd9832.bin.exe	156
PID 5332 wrote to memory of 6112	5332	cmd.exe	158
PID 1164 wrote to memory of 5872	1164	cmd.exe	159

C:\Users\Admin\AppData\Local\Temp\72dcf3b5d7cd9832.bin.exe
"C:\Users\Admin\AppData\Local\Temp\72dcf3b5d7cd9832.bin.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1148
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2364
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5508
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1824
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:468
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4676
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5884
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3692
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4424
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1360
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1268
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6036
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2880
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4752
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1564
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6112
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4928
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4528
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2812
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5060
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4916
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5380
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2768
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5544
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5064
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2388
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5844
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3372
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4164
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1984
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1088
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:268
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4488
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4220

C:\Users\Admin\AppData\Local\Temp\72dcf3b5d7cd9832.bin.exe
C:\Users\Admin\AppData\Local\Temp\72dcf3b5d7cd9832.bin.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2928
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3492
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3472
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2684
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2836
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4488
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4864
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5896
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1656
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3084
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3748
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5588
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5252
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2024
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3804
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5872
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4308
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5616
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2444
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4712
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:700
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4828
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3436
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4340
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:244
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4104
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:624
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3184
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1480
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2020
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2836
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3520
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-16-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-24-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-28-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-3-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-26-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-5-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-13-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-7-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-22-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-9-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-20-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-11-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-1-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/2536-18-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-6-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-27-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-17-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-12-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-19-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-4-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-23-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-8-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-15-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-21-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-25-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-0-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-10-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

memory/3904-2-0x00007FF7B9010000-0x00007FF7B91F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads