Behavioral Analysis

cmd.exe cmd.exe /c dir C:\

cacls.exe cacls.exe C:\ProgramData\DNTException /t /e /c /g Everyone:F

icacls.exe icacls.exe C:\ProgramData\DNTException /t /c /grant *S-1-1-0:(f)

attrib.exe attrib.exe +H C:\ProgramData\DNTException

attrib.exe attrib.exe +H C:\ProgramData\DNTException\node.exe

cacls.exe cacls.exe C:\ProgramData\Intel /t /e /c /g Everyone:F

icacls.exe icacls.exe C:\ProgramData\Intel /t /c /grant *S-1-1-0:(f)

attrib.exe attrib.exe +H C:\ProgramData\Intel

attrib.exe attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components"

attrib.exe attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 4206229241"

attrib.exe attrib.exe +H "C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 3095983164"

reg.exe reg.exe query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

reg.exe reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Intel Management Engine Components 1150041058" /t REG_SZ /d "wscript.exe /t:30 /nologo /e:jscript \"C:\ProgramData\Intel\Intel(R) Management Engine Components\Intel MEC 3095983164\" \"C:\ProgramData\Intel\Intel(R) Management Engine Components\" 1581449722" /f

tasklist.exe tasklist /fo csv /nh

WMIC.exe wmic process get processid,parentprocessid,name,executablepath /format:csv

ipconfig.exe ipconfig.exe /all

ROUTE.EXE route.exe print

NETSTAT.EXE netstat.exe -ano

systeminfo.exe systeminfo.exe /fo csv

reg.exe reg.exe query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}

reg.exe reg.exe query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000