1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
Size 2.0MB
Sample261023-ncqa6sbs6z
SHA256 1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8
MD5 7f1c601398e801e0dd555c1fb53b1b30
SHA1 569c9a649de8d0c1c5050461adf66f009fee03ce
SHA512 26fd8c3bf8352ad5be49366fdf459058bee45afc7f39e22df4cbe0c5b6a92faf5148264b88a6d2e564cec18d0ae2f7432468feeeec64b7716b9964322ab57476
SSDEEP 49152:nxiPKcd+KIimJzHnspxnG9rBesU8AIU6isK:nx2dD8rUm+sK
TLSH
T1B3956D43E69580FCD49AC0B8C3479632EA22BC8E092176AF27D09F653E67F509F0DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Helper 525 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe"	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Provider 120 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe"	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	api.ipify.org
1	api.ipify.org
4	api.ipify.org

Executes a command shell one-liner 1 TTPs 56 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3672	cmd.exe
2868	cmd.exe
5148	cmd.exe
6064	cmd.exe
1992	cmd.exe
4168	cmd.exe
1988	cmd.exe
1656	cmd.exe
4724	cmd.exe
2900	cmd.exe
2096	cmd.exe
1972	cmd.exe
4920	cmd.exe
1108	cmd.exe
5980	cmd.exe
3508	cmd.exe
6028	cmd.exe
3880	cmd.exe
1664	cmd.exe
108	cmd.exe
4716	cmd.exe
1288	cmd.exe
4520	cmd.exe
932	cmd.exe
4900	cmd.exe
5972	cmd.exe
1924	cmd.exe
764	cmd.exe
2488	cmd.exe
5036	cmd.exe
724	cmd.exe
1804	cmd.exe
4560	cmd.exe
4568	cmd.exe
4300	cmd.exe
828	cmd.exe
2160	cmd.exe
1284	cmd.exe
3068	cmd.exe
4320	cmd.exe
2256	cmd.exe
2644	cmd.exe
712	cmd.exe
4748	cmd.exe
3024	cmd.exe
3620	cmd.exe
4676	cmd.exe
4076	cmd.exe
4588	cmd.exe
672	cmd.exe
4108	cmd.exe
5020	cmd.exe
5284	cmd.exe
2580	cmd.exe
5088	cmd.exe
264	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe

Gathers network information 2 TTPs 56 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2876	ipconfig.exe
4632	ipconfig.exe
1768	ipconfig.exe
1428	ipconfig.exe
3944	ipconfig.exe
2616	ipconfig.exe
5096	ipconfig.exe
4864	ipconfig.exe
1864	ipconfig.exe
692	ipconfig.exe
5804	ipconfig.exe
5880	ipconfig.exe
4960	ipconfig.exe
1452	ipconfig.exe
4492	ipconfig.exe
4124	ipconfig.exe
5204	ipconfig.exe
1656	ipconfig.exe
2848	ipconfig.exe
2984	ipconfig.exe
2928	ipconfig.exe
5560	ipconfig.exe
5224	ipconfig.exe
2640	ipconfig.exe
4580	ipconfig.exe
5068	ipconfig.exe
3440	ipconfig.exe
5400	ipconfig.exe
720	ipconfig.exe
3944	ipconfig.exe
3872	ipconfig.exe
5272	ipconfig.exe
5040	ipconfig.exe
4580	ipconfig.exe
3920	ipconfig.exe
200	ipconfig.exe
3116	ipconfig.exe
344	ipconfig.exe
432	ipconfig.exe
5344	ipconfig.exe
5048	ipconfig.exe
5868	ipconfig.exe
5636	ipconfig.exe
5760	ipconfig.exe
3896	ipconfig.exe
1448	ipconfig.exe
1392	ipconfig.exe
1488	ipconfig.exe
6072	ipconfig.exe
5264	ipconfig.exe
2808	ipconfig.exe
5988	ipconfig.exe
2364	ipconfig.exe
2992	ipconfig.exe
4496	ipconfig.exe
5724	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
Token: SeDebugPrivilege	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
Token: SeLoadDriverPrivilege	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
Token: SeDebugPrivilege	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 6028	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	90
PID 6028 wrote to memory of 5560	6028	cmd.exe	92
PID 236 wrote to memory of 828	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	96
PID 828 wrote to memory of 2616	828	cmd.exe	98
PID 4856 wrote to memory of 4748	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	100
PID 4748 wrote to memory of 1452	4748	cmd.exe	102
PID 236 wrote to memory of 5020	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	103
PID 5020 wrote to memory of 4492	5020	cmd.exe	105
PID 4856 wrote to memory of 5284	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	106
PID 5284 wrote to memory of 3896	5284	cmd.exe	108
PID 236 wrote to memory of 2160	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	109
PID 2160 wrote to memory of 3944	2160	cmd.exe	111
PID 4856 wrote to memory of 2580	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	112
PID 2580 wrote to memory of 4124	2580	cmd.exe	114
PID 236 wrote to memory of 3880	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	115
PID 3880 wrote to memory of 1448	3880	cmd.exe	117
PID 4856 wrote to memory of 2488	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	118
PID 2488 wrote to memory of 5224	2488	cmd.exe	120
PID 236 wrote to memory of 5148	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	121
PID 5148 wrote to memory of 5096	5148	cmd.exe	123
PID 4856 wrote to memory of 1664	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	124
PID 1664 wrote to memory of 2640	1664	cmd.exe	126
PID 236 wrote to memory of 4900	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	127
PID 4900 wrote to memory of 5204	4900	cmd.exe	129
PID 4856 wrote to memory of 5036	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	131
PID 5036 wrote to memory of 3872	5036	cmd.exe	133
PID 236 wrote to memory of 5088	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	134
PID 5088 wrote to memory of 1656	5088	cmd.exe	136
PID 4856 wrote to memory of 2096	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	137
PID 2096 wrote to memory of 2876	2096	cmd.exe	139
PID 236 wrote to memory of 5972	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	140
PID 5972 wrote to memory of 3116	5972	cmd.exe	142
PID 4856 wrote to memory of 6064	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	143
PID 6064 wrote to memory of 4580	6064	cmd.exe	145
PID 236 wrote to memory of 1992	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	146
PID 1992 wrote to memory of 4864	1992	cmd.exe	148
PID 4856 wrote to memory of 4168	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	149
PID 4168 wrote to memory of 1864	4168	cmd.exe	151
PID 236 wrote to memory of 1284	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	152
PID 1284 wrote to memory of 2848	1284	cmd.exe	154
PID 4856 wrote to memory of 3024	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	155
PID 3024 wrote to memory of 4632	3024	cmd.exe	157
PID 236 wrote to memory of 3620	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	158
PID 3620 wrote to memory of 344	3620	cmd.exe	160
PID 4856 wrote to memory of 108	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	161
PID 108 wrote to memory of 432	108	cmd.exe	163
PID 236 wrote to memory of 264	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	164
PID 264 wrote to memory of 5068	264	cmd.exe	166
PID 4856 wrote to memory of 1972	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	167
PID 1972 wrote to memory of 2364	1972	cmd.exe	169
PID 236 wrote to memory of 4676	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	170
PID 4676 wrote to memory of 3440	4676	cmd.exe	172
PID 4856 wrote to memory of 724	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	173
PID 724 wrote to memory of 692	724	cmd.exe	175
PID 236 wrote to memory of 1988	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	176
PID 1988 wrote to memory of 1392	1988	cmd.exe	178
PID 4856 wrote to memory of 4716	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	179
PID 4716 wrote to memory of 5400	4716	cmd.exe	181
PID 236 wrote to memory of 4076	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	182
PID 4076 wrote to memory of 5272	4076	cmd.exe	184
PID 4856 wrote to memory of 3068	4856	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	185
PID 3068 wrote to memory of 5040	3068	cmd.exe	187
PID 236 wrote to memory of 1804	236	1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe	188
PID 1804 wrote to memory of 2984	1804	cmd.exe	190

C:\Users\Admin\AppData\Local\Temp\1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
"C:\Users\Admin\AppData\Local\Temp\1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5560
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1452
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3896
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4124
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5224
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2640
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3872
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2876
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4580
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1864
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4632
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:432
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2364
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:692
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5400
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5040
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1288
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1768
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4588
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2992
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1656
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1488
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:764
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4580
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1108
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4496
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:672
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5264
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4568
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2808
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2868
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3944
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5980
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5988
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:712
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5868
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4300
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5724

C:\Users\Admin\AppData\Local\Temp\1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
C:\Users\Admin\AppData\Local\Temp\1e4a4280d7d49aca55d027e29c19eb4feac2ed6f855fbe0663278a39e64cd4b8.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:236
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2616
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4492
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3944
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1448
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5096
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5204
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1656
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3116
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4864
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2848
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:344
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5068
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1392
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5272
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2984
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3672
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2928
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4520
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:720
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1924
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6072
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4920
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5804
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4560
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5344
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4724
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1428
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4108
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5880
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2900
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3920
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2256
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4960
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2644
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:200
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3508
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5636
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:932
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5760