d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24.exe
Size 6.3MB
Sample261030-tbbdhsev7m
SHA256 d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24
MD5 f0e99bf985b4dbf4734603c6b8505fc5
SHA1 12de2cb4b27f415ca69cad1dd4849ca59e92e878
SHA512 b50a2c35750a65ec28961e946212e00664d8d3f7bb9197e914c72794df3bdd02da1943d7e90f2cbfe4d5deead4020c90744301c81fc3470a0bb4acd0cecf8021
SSDEEP 49152:JILh3xUTBy6rtWgBRM2OuIbIYIBA/GlE3izayT6p8McMjx5EVoQssVeMc+h4iUBt:fB36//MA/G7MEy81c+05Oi
TLSH
T17E665B07FCA545E9C0AED635CA629263BA717C484B3063D76B50F7382F76BD0AA79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
4460	svchost.exe
856	svchost.exe
4068	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\NIKClient = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network\\svchost.exe\""	reg.exe

Discovers running processes 1 TTPs 36 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2464	tasklist.exe
4596	tasklist.exe
2380	tasklist.exe
2544	tasklist.exe
2092	tasklist.exe
2256	tasklist.exe
4928	tasklist.exe
3140	tasklist.exe
5024	tasklist.exe
4920	tasklist.exe
1108	tasklist.exe
5200	tasklist.exe
2368	tasklist.exe
3332	tasklist.exe
3408	tasklist.exe
1452	tasklist.exe
1384	tasklist.exe
3924	tasklist.exe
4696	tasklist.exe
3756	tasklist.exe
1156	tasklist.exe
5448	tasklist.exe
5340	tasklist.exe
3140	tasklist.exe
4720	tasklist.exe
4856	tasklist.exe
2500	tasklist.exe
3648	tasklist.exe
4224	tasklist.exe
4840	tasklist.exe
2192	tasklist.exe
708	tasklist.exe
820	tasklist.exe
3648	tasklist.exe
936	tasklist.exe
5528	tasklist.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5180	cmd.exe
4888	cmd.exe
3408	cmd.exe
5844	cmd.exe
1856	cmd.exe
5528	cmd.exe
1404	cmd.exe
3704	cmd.exe
2860	cmd.exe
5544	cmd.exe
5412	cmd.exe
4264	cmd.exe
3328	cmd.exe
5252	cmd.exe
468	cmd.exe
4288	cmd.exe
4528	cmd.exe
1216	cmd.exe
1188	cmd.exe
1608	cmd.exe
4956	cmd.exe
4328	cmd.exe
2080	cmd.exe
3440	cmd.exe
5232	cmd.exe
3872	cmd.exe
3756	cmd.exe
2576	cmd.exe
5860	cmd.exe
5672	cmd.exe
5944	cmd.exe
2384	cmd.exe
5608	cmd.exe
3692	cmd.exe
5964	cmd.exe
2816	cmd.exe
2532	cmd.exe
5280	cmd.exe
2944	cmd.exe
4752	cmd.exe
2336	cmd.exe
5068	cmd.exe
5760	cmd.exe
4100	cmd.exe
5484	cmd.exe
2608	cmd.exe
5648	cmd.exe
3216	cmd.exe
4832	cmd.exe
4580	cmd.exe
1356	cmd.exe
1120	cmd.exe
3948	cmd.exe
5816	cmd.exe
248	cmd.exe
2340	cmd.exe
5144	cmd.exe
1940	cmd.exe
948	cmd.exe
3124	cmd.exe
5392	cmd.exe
3520	cmd.exe
3332	cmd.exe
260	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
936	PING.EXE

Gathers network information 2 TTPs 63 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5092	ipconfig.exe
1820	ipconfig.exe
4920	ipconfig.exe
2836	ipconfig.exe
4712	ipconfig.exe
5348	ipconfig.exe
2088	ipconfig.exe
2804	ipconfig.exe
2456	ipconfig.exe
5428	ipconfig.exe
4636	ipconfig.exe
5004	ipconfig.exe
5184	ipconfig.exe
3052	ipconfig.exe
5756	ipconfig.exe
4692	ipconfig.exe
3104	ipconfig.exe
6104	ipconfig.exe
3500	ipconfig.exe
3248	ipconfig.exe
5024	ipconfig.exe
5592	ipconfig.exe
1700	ipconfig.exe
6036	ipconfig.exe
2168	ipconfig.exe
3304	ipconfig.exe
4104	ipconfig.exe
3008	ipconfig.exe
5672	ipconfig.exe
828	ipconfig.exe
3112	ipconfig.exe
5652	ipconfig.exe
2856	ipconfig.exe
5408	ipconfig.exe
4932	ipconfig.exe
3264	ipconfig.exe
5840	ipconfig.exe
4600	ipconfig.exe
2388	ipconfig.exe
5668	ipconfig.exe
2936	ipconfig.exe
4108	ipconfig.exe
6128	ipconfig.exe
1844	ipconfig.exe
1388	ipconfig.exe
5916	ipconfig.exe
4384	ipconfig.exe
4448	ipconfig.exe
4944	ipconfig.exe
124	ipconfig.exe
2168	ipconfig.exe
5088	ipconfig.exe
4688	ipconfig.exe
4856	ipconfig.exe
3204	ipconfig.exe
5052	ipconfig.exe
3492	ipconfig.exe
4108	ipconfig.exe
2988	ipconfig.exe
4540	ipconfig.exe
3188	ipconfig.exe
1836	ipconfig.exe
4192	ipconfig.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4312	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
936	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2344	WMIC.exe
2344	WMIC.exe
2344	WMIC.exe
2344	WMIC.exe
5444	WMIC.exe
5444	WMIC.exe
5444	WMIC.exe
5444	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
4792	WMIC.exe
4792	WMIC.exe
4792	WMIC.exe
4792	WMIC.exe
1744	WMIC.exe
1744	WMIC.exe
1744	WMIC.exe
1744	WMIC.exe
948	WMIC.exe
948	WMIC.exe
948	WMIC.exe
948	WMIC.exe
2456	WMIC.exe
2456	WMIC.exe
2456	WMIC.exe
2456	WMIC.exe
4456	WMIC.exe
4456	WMIC.exe
4456	WMIC.exe
4456	WMIC.exe
3036	WMIC.exe
3036	WMIC.exe
3036	WMIC.exe
3036	WMIC.exe
4384	WMIC.exe
4384	WMIC.exe
4384	WMIC.exe
4384	WMIC.exe
2344	WMIC.exe
2344	WMIC.exe
2344	WMIC.exe
2344	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
3376	WMIC.exe
3376	WMIC.exe
3376	WMIC.exe
3376	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
5368	WMIC.exe
5368	WMIC.exe
5368	WMIC.exe
5368	WMIC.exe
3104	WMIC.exe
3104	WMIC.exe
3104	WMIC.exe
3104	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2344	WMIC.exe
Token: SeSecurityPrivilege	2344	WMIC.exe
Token: SeTakeOwnershipPrivilege	2344	WMIC.exe
Token: SeLoadDriverPrivilege	2344	WMIC.exe
Token: SeSystemProfilePrivilege	2344	WMIC.exe
Token: SeSystemtimePrivilege	2344	WMIC.exe
Token: SeProfSingleProcessPrivilege	2344	WMIC.exe
Token: SeIncBasePriorityPrivilege	2344	WMIC.exe
Token: SeCreatePagefilePrivilege	2344	WMIC.exe
Token: SeBackupPrivilege	2344	WMIC.exe
Token: SeRestorePrivilege	2344	WMIC.exe
Token: SeShutdownPrivilege	2344	WMIC.exe
Token: SeDebugPrivilege	2344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2344	WMIC.exe
Token: SeRemoteShutdownPrivilege	2344	WMIC.exe
Token: SeUndockPrivilege	2344	WMIC.exe
Token: SeManageVolumePrivilege	2344	WMIC.exe
Token: 33	2344	WMIC.exe
Token: 34	2344	WMIC.exe
Token: 35	2344	WMIC.exe
Token: 36	2344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2344	WMIC.exe
Token: SeSecurityPrivilege	2344	WMIC.exe
Token: SeTakeOwnershipPrivilege	2344	WMIC.exe
Token: SeLoadDriverPrivilege	2344	WMIC.exe
Token: SeSystemProfilePrivilege	2344	WMIC.exe
Token: SeSystemtimePrivilege	2344	WMIC.exe
Token: SeProfSingleProcessPrivilege	2344	WMIC.exe
Token: SeIncBasePriorityPrivilege	2344	WMIC.exe
Token: SeCreatePagefilePrivilege	2344	WMIC.exe
Token: SeBackupPrivilege	2344	WMIC.exe
Token: SeRestorePrivilege	2344	WMIC.exe
Token: SeShutdownPrivilege	2344	WMIC.exe
Token: SeDebugPrivilege	2344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2344	WMIC.exe
Token: SeRemoteShutdownPrivilege	2344	WMIC.exe
Token: SeUndockPrivilege	2344	WMIC.exe
Token: SeManageVolumePrivilege	2344	WMIC.exe
Token: 33	2344	WMIC.exe
Token: 34	2344	WMIC.exe
Token: 35	2344	WMIC.exe
Token: 36	2344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5444	WMIC.exe
Token: SeSecurityPrivilege	5444	WMIC.exe
Token: SeTakeOwnershipPrivilege	5444	WMIC.exe
Token: SeLoadDriverPrivilege	5444	WMIC.exe
Token: SeSystemProfilePrivilege	5444	WMIC.exe
Token: SeSystemtimePrivilege	5444	WMIC.exe
Token: SeProfSingleProcessPrivilege	5444	WMIC.exe
Token: SeIncBasePriorityPrivilege	5444	WMIC.exe
Token: SeCreatePagefilePrivilege	5444	WMIC.exe
Token: SeBackupPrivilege	5444	WMIC.exe
Token: SeRestorePrivilege	5444	WMIC.exe
Token: SeShutdownPrivilege	5444	WMIC.exe
Token: SeDebugPrivilege	5444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5444	WMIC.exe
Token: SeRemoteShutdownPrivilege	5444	WMIC.exe
Token: SeUndockPrivilege	5444	WMIC.exe
Token: SeManageVolumePrivilege	5444	WMIC.exe
Token: 33	5444	WMIC.exe
Token: 34	5444	WMIC.exe
Token: 35	5444	WMIC.exe
Token: 36	5444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5444	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 4460	3420	d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24.exe	88
PID 3420 wrote to memory of 4528	3420	d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24.exe	89
PID 4460 wrote to memory of 4312	4460	svchost.exe	91
PID 4528 wrote to memory of 936	4528	cmd.exe	93
PID 4460 wrote to memory of 856	4460	svchost.exe	94
PID 4460 wrote to memory of 5092	4460	svchost.exe	95
PID 4460 wrote to memory of 4580	4460	svchost.exe	98
PID 4580 wrote to memory of 1388	4580	cmd.exe	100
PID 4460 wrote to memory of 4976	4460	svchost.exe	101
PID 4976 wrote to memory of 2344	4976	cmd.exe	103
PID 4460 wrote to memory of 1548	4460	svchost.exe	106
PID 1548 wrote to memory of 5592	1548	cmd.exe	108
PID 4460 wrote to memory of 3032	4460	svchost.exe	109
PID 3032 wrote to memory of 5444	3032	cmd.exe	111
PID 856 wrote to memory of 4696	856	svchost.exe	112
PID 4460 wrote to memory of 2944	4460	svchost.exe	114
PID 2944 wrote to memory of 4192	2944	cmd.exe	116
PID 4460 wrote to memory of 3152	4460	svchost.exe	117
PID 3152 wrote to memory of 1500	3152	cmd.exe	119
PID 4460 wrote to memory of 2032	4460	svchost.exe	120
PID 2032 wrote to memory of 2388	2032	cmd.exe	122
PID 4460 wrote to memory of 4180	4460	svchost.exe	123
PID 4180 wrote to memory of 4792	4180	cmd.exe	125
PID 856 wrote to memory of 4928	856	svchost.exe	126
PID 4460 wrote to memory of 1216	4460	svchost.exe	128
PID 1216 wrote to memory of 1820	1216	cmd.exe	130
PID 4460 wrote to memory of 2232	4460	svchost.exe	131
PID 2232 wrote to memory of 1744	2232	cmd.exe	133
PID 4460 wrote to memory of 476	4460	svchost.exe	134
PID 476 wrote to memory of 3104	476	cmd.exe	136
PID 4460 wrote to memory of 3736	4460	svchost.exe	137
PID 3736 wrote to memory of 948	3736	cmd.exe	139
PID 856 wrote to memory of 4920	856	svchost.exe	140
PID 4460 wrote to memory of 4288	4460	svchost.exe	142
PID 4288 wrote to memory of 3008	4288	cmd.exe	144
PID 4460 wrote to memory of 5964	4460	svchost.exe	145
PID 5964 wrote to memory of 2456	5964	cmd.exe	147
PID 856 wrote to memory of 3140	856	svchost.exe	148
PID 4460 wrote to memory of 204	4460	svchost.exe	150
PID 204 wrote to memory of 4856	204	cmd.exe	152
PID 4460 wrote to memory of 5608	4460	svchost.exe	153
PID 5608 wrote to memory of 4456	5608	cmd.exe	155
PID 4460 wrote to memory of 4328	4460	svchost.exe	156
PID 4328 wrote to memory of 5428	4328	cmd.exe	158
PID 4460 wrote to memory of 5412	4460	svchost.exe	159
PID 5412 wrote to memory of 3036	5412	cmd.exe	161
PID 856 wrote to memory of 3756	856	svchost.exe	162
PID 4460 wrote to memory of 952	4460	svchost.exe	164
PID 952 wrote to memory of 4944	952	cmd.exe	166
PID 4460 wrote to memory of 4248	4460	svchost.exe	167
PID 4248 wrote to memory of 4384	4248	cmd.exe	169
PID 4460 wrote to memory of 2816	4460	svchost.exe	170
PID 2816 wrote to memory of 3204	2816	cmd.exe	172
PID 4460 wrote to memory of 3268	4460	svchost.exe	173
PID 3268 wrote to memory of 2344	3268	cmd.exe	175
PID 856 wrote to memory of 4596	856	svchost.exe	176
PID 4460 wrote to memory of 3468	4460	svchost.exe	178
PID 3468 wrote to memory of 1700	3468	cmd.exe	180
PID 4460 wrote to memory of 4752	4460	svchost.exe	181
PID 4752 wrote to memory of 4908	4752	cmd.exe	183
PID 856 wrote to memory of 1156	856	svchost.exe	185
PID 4460 wrote to memory of 1424	4460	svchost.exe	187
PID 1424 wrote to memory of 5052	1424	cmd.exe	189
PID 4460 wrote to memory of 5180	4460	svchost.exe	190

C:\Users\Admin\AppData\Local\Temp\d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24.exe
"C:\Users\Admin\AppData\Local\Temp\d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NIKClient /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe\" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4312
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe --watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4696
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4928
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4920
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3140
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4596
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1156
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3332
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5448
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4856
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1108
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3408
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1452
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2500
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:708
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2380
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4224
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5340
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5200
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5024
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:820
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4840
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:936
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2092
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5528
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2256
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3140
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1384
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2368
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2192
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3924
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2544
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4460" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2464
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
    3⤵
    PID:5092
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:1388
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2344
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5592
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5444
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4192
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1500
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2388
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4792
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:1820
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1744
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3104
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:948
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3008
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2456
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4856
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5608
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4456
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5428
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3036
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4944
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4384
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3204
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2344
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:1700
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4908
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5052
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5180
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3376
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:1120
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3492
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:2068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1500
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:4792
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5184
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:1188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5368
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:4924
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4108
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:4100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3104
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:2608
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4920
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:2208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2896
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:5440
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3052
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:5920
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:6028
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:5392
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5408
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:3948
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5472
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:4620
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5668
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:3704
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4960
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:5240
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:124
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:2336
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:6016
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:4596
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2088
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:472
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:2080
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5916
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:1404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1280
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:3692
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2836
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:3520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4292
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:5816
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4932
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5232
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1772
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:1420
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2168
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:2844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1928
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:948
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:6104
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:260
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1236
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:248
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3264
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5648
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:4576
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:1608
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3112
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:2340
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3800
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:5656
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5672
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:3036
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:928
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:3872
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5088
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:4640
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3108
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:3900
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4688
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:3700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:936
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:4132
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5840
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:4260
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3824
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:2548
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4712
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:2312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1124
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:2096
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:6036
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:1500
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:1504
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:2576
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2168
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:3440
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:2556
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:1928
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2804
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:2532
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5324
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:5860
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4636
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:3044
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3432
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:3124
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2988
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:1916
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:5484
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2856
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:2860
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:2612
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:4888
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5092
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5672
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2660
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:5056
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4540
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:1972
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5264
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:5788
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4384
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:4376
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3396
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:6004
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3188
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:4688
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4304
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:5576
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4448
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:5916
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2192
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:468
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5652
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:1356
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1256
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:1100
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:1844
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5760
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:240
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:3216
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5756
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:3332
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2544
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:5144
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3500
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:1940
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2760
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:1332
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5024
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:4264
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:3876
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:3532
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2456
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:4348
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1252
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:5944
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4692
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:3716
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2520
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:4068
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3304
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:3756
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:2648
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:4832
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:1836
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:1876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:2288
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:3408
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4104
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:5132
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:4724
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:1856
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:828
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:5268
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:5288
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:5844
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3248
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5280
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5052
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:5168
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5004
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:1124
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4756
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    - Executes a command shell one-liner
    PID:5528
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:2936
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:3328
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      PID:2156
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:5968
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4108
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    PID:6084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:5324
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:3136
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4600
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:2384
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1236
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:4516
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:6128
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:4956
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3052
- - C:\Windows\system32\cmd.exe
    cmd /c ipconfig
    3⤵
    PID:2716
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:5348
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic os get lastbootuptime /value"
    3⤵
    - Executes a command shell one-liner
    PID:5544
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get lastbootuptime /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2832
- C:\Windows\system32\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\nik_1793375557771379400.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:936

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe"
1⤵
- Executes dropped EXE
PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nik_1793375557771379400.bat

Path C:\Users\Admin\AppData\Local\Temp\nik_1793375557771379400.bat
Size 166B
SHA256 a66850b8305ec38a273b6ce4bfa7f03ce711fc9394491f4b6d84addb8c4234f8
MD5 155f928d86ed216aae4e86f3c3564397
SHA1 56dfde66e1e6926a129dd1750be147fd7bcc21fd
SHA512 4095468f00338fc17d3a2d3808f4856afe8e27f3ce86d09494358c62bf72f138d30dd54cab9353b85c4c9a34d59b944792e26c7e1c64c8049981236fde396dda
TLSH
T12EC0800354254F513719505146ED909DC81F598616476590195544BD1ED5055417D6C4
MD5 SHA1 SHA512 TLSH

Submit Download

nik_b6f6eda048ab201f.pid

Path C:\Users\Admin\AppData\Local\Temp\nik_b6f6eda048ab201f.pid
Size 4B
SHA256 731e88ce52c6febf8c04dbf5e208e3e46da85bf219313f31f56225f29024f36b
MD5 61bdf049525b7d4c2cf79257ec7c2c56
SHA1 2b815c4e87f14f50a53643f270edbf7c48ae989c
SHA512 125f17a095c9ae993fe0a22ca3e69c31c42fadc9960a772ac6a5f3ab3e0f7924bacbd5947671ab2fb292afb7c98616761ef66ca8365c810bc6bd156506056835
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network\svchost.exe
Size 6.3MB
SHA256 d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24
MD5 f0e99bf985b4dbf4734603c6b8505fc5
SHA1 12de2cb4b27f415ca69cad1dd4849ca59e92e878
SHA512 b50a2c35750a65ec28961e946212e00664d8d3f7bb9197e914c72794df3bdd02da1943d7e90f2cbfe4d5deead4020c90744301c81fc3470a0bb4acd0cecf8021
SSDEEP 49152:JILh3xUTBy6rtWgBRM2OuIbIYIBA/GlE3izayT6p8McMjx5EVoQssVeMc+h4iUBt:fB36//MA/G7MEy81c+05Oi
TLSH
T17E665B07FCA545E9C0AED635CA629263BA717C484B3063D76B50F7382F76BD0AA79700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download