95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

General
Target

95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

Filesize

986KB

Completed

11-02-2020 13:56

Score
10 /10
MD5

934984b11e6690c10e7ad5bf1f0cf274

SHA1

5c826f0bca1460508b0a3db4b0e5f9fbd7c2104f

SHA256

95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

Malware Config
Signatures 13

Filter: none

Persistence
  • Ouroboros/Zeropadypt

    Description

    Ransomware family based on open-source CryptoWire.

  • xmrig

    Description

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    Tags

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Modifies extensions of user files
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\Pictures\RenameUnregister.tiff95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Drops startup file
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Drops desktop.ini file(s)
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CZUF3YTD\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Public\Desktop\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Public\Recorded TV\Sample Media\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Public\Videos\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\Links\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\Favorites\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Raga\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RHK1DJ5\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BA8Z0IE6\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Public\Videos\Sample Videos\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Festival\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\Favorites\Links for United States\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\Pictures\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Public\Music\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Calligraphy\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Savanna\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Offline Web Pages\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Heritage\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\$Recycle.Bin\S-1-5-21-1774239815-1814403401-2200974991-1000\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\Videos\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Afternoon\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Landscape\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Public\Documents\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Public\Downloads\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Media\Garden\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\Downloads\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Public\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    descriptionflowioc
    HTTP URL7http://www.sfml-dev.org/ip-provider.php
  • Drops file in System32 directory
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SysWOW64\infocardapi.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\mcbuilder.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\netapi32.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\iertutil.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\dmscript.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\ftp.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\idndl.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\ieapfltr.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\netbios.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\NlsLexicons004a.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\forfiles.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\drmmgrtn.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\Kswdmcap.ax95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\msdadiag.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\mycomput.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\NlsData0021.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\FXSCOM.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\fthsvc.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\MsCtfMonitor.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\NaturalLanguage6.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\ndadmin.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\NlsData000f.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\C_10005.NLS95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\fdProxy.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\fontext.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\nci.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\elslad.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\dpnhupnp.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\muifontsetup.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\miutils.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\DeviceCenter.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\C_720.NLS95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\duser.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\KBDARMW.DLL95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\hnetmon.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\dimsjob.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\dmloader.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\nsi.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\C_866.NLS95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\C_863.NLS95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\dpx.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\dsrole.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\bitsprx5.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\autoconv.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\C_IS2022.DLL95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\dplaysvr.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\iac25_32.ax95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\netprofm.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\BWUnpairElevated.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\findstr.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\msdtcuiu.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\msnetobj.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\nlsbres.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\regedit.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\azroleui.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\clfsw32.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\extrac32.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\fphc.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SysWOW64\imapi2fs.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Drops file in Program Files directory
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\Office14\PROOF\MSTH7FR.LEX95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099175.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0174639.WMF95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.HK.XML95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\America\St_Johns.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00527_.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01300_.GIF95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\Office14\msproof7.dll.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099157.JPG95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMaskSmall.bmp95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\Stationery\1033\NOTEBOOK.JPG95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0300912.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\Microsoft.Ink.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jre7\bin\t2k.dll.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\CAPSULES.ELM.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0212701.WMF.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.HOL95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jre7\lib\zi\America\Eirunepe.Email=[lilmoonhack6677@protonmail.com]ID=[GYOT86K5IU3HRD1].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Drops file in Windows directory
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\ehome\CreateDisc\SFXPlugins\StandardFX_Plugin.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\inf\hpoa1ss.inf95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Resources.Writer.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\AppLocker.psd195a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.VisualC\74de34cd518bf49352c8346149ddfbc1\Microsoft.VisualC.ni.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ehome\segoemcl.ttf95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\IME\IMESC5\DICTS\PINTLGB.IMD95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\NetFx40_IIS_schema_update.xml95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe.aux95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Globalization\MCT\MCT-GB\Link\GB-3.url95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\PolicyDefinitions\Explorer.admx95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-Graphics-Package~31bf3856ad364e35~amd64~et-EE~7.1.7601.16492.mum95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\AppPatch\AcLayers.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.config95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ehome\CreateDisc\Components\tables\alloc_095a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v2.0.50727\normnfc.nlp95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v4.0.30319\System.AddIn.Contract.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.mum95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.ApplicationId.Framework.Resources.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\NativeImages_v2.0.50727_64\System.Runtime.Seri#\8ad0e1382ab6565741bbb64b965f2748\System.Runtime.Serialization.Formatters.Soap.ni.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv14b62006#\2c7e795fb7d690d3b8931d360e4ce7f5\System.ServiceModel.Activation.ni.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.Classic.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package-wrapper~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.mum95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.mum95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ehome\CreateDisc\Components\tables\1th295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Common.OverrideTasks95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package~31bf3856ad364e35~amd64~ar-SA~7.1.7601.16492.cat95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\NativeImages_v4.0.30319_32\System.Acti2661942e#\84846480d6281bf831a97d07f712d09e\System.Activities.DurableInstancing.ni.dll.aux95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\en-US\CL_LocalizationData.psd195a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\inf\mdmbsb.inf95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationHostDLL.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Microsoft-Windows-BusinessScanning-Feature-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb00009.log95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\60b93ce08d30a2fba087f8630a504cb8\System.ServiceModel.Web.ni.dll.aux95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Fonts\svgasys.fon95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Routing.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\_ServiceModelEndpointPerfCounters.vrg95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-DownlevelApisets-Com-WinIP-Package~31bf3856ad364e35~amd64~sl-SI~7.1.7601.16492.mum95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-Graphics-Package~31bf3856ad364e35~amd64~en-GB~7.1.7601.16492.mum95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\e27ae693b6e71bb689ec66761a65901f\System.ServiceModel.ni.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\inf\mdm5674a.inf95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\inf\tsgenericusbdriver.inf95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v4.0.30319\_dataperfcounters_shared12_neutral.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.resx95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\PLA\Reports\Report.System.Summary.xml95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-WMIProvider-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.mum95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\CvtResUI.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayback-OC-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\ehome\MediaCenterWebLauncher.exe.manifest95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.MemoryMappedFiles.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Fonts\8514oem.fon95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\inf\prnxx002.PNF95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe.config95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1053\eula.rtf95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\assembly\NativeImages_v4.0.30319_32\System.Iden1fe87377#\2a8d6efe5a99d9e6b03587df841c2087\System.IdentityModel.Services.ni.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\inf\mdmosi.inf95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Windows\servicing\Packages\Microsoft-Windows-LocalPack-CA-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    pidprocess
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Suspicious use of WriteProcessMemory
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1108 wrote to memory of 1264110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1264110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1264110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1264110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1264 wrote to memory of 11561264cmd.exenet.exe
    PID 1264 wrote to memory of 11561264cmd.exenet.exe
    PID 1264 wrote to memory of 11561264cmd.exenet.exe
    PID 1264 wrote to memory of 11561264cmd.exenet.exe
    PID 1156 wrote to memory of 8201156net.exenet1.exe
    PID 1156 wrote to memory of 8201156net.exenet1.exe
    PID 1156 wrote to memory of 8201156net.exenet1.exe
    PID 1156 wrote to memory of 8201156net.exenet1.exe
    PID 1108 wrote to memory of 1020110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1020110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1020110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1020110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1020 wrote to memory of 14081020cmd.exenet.exe
    PID 1020 wrote to memory of 14081020cmd.exenet.exe
    PID 1020 wrote to memory of 14081020cmd.exenet.exe
    PID 1020 wrote to memory of 14081020cmd.exenet.exe
    PID 1408 wrote to memory of 14681408net.exenet1.exe
    PID 1408 wrote to memory of 14681408net.exenet1.exe
    PID 1408 wrote to memory of 14681408net.exenet1.exe
    PID 1408 wrote to memory of 14681408net.exenet1.exe
    PID 1108 wrote to memory of 1440110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1440110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1440110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1440110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1440 wrote to memory of 14601440cmd.exenet.exe
    PID 1440 wrote to memory of 14601440cmd.exenet.exe
    PID 1440 wrote to memory of 14601440cmd.exenet.exe
    PID 1440 wrote to memory of 14601440cmd.exenet.exe
    PID 1460 wrote to memory of 5961460net.exenet1.exe
    PID 1460 wrote to memory of 5961460net.exenet1.exe
    PID 1460 wrote to memory of 5961460net.exenet1.exe
    PID 1460 wrote to memory of 5961460net.exenet1.exe
    PID 1108 wrote to memory of 544110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 544110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 544110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 544110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 544 wrote to memory of 1348544cmd.exenet.exe
    PID 544 wrote to memory of 1348544cmd.exenet.exe
    PID 544 wrote to memory of 1348544cmd.exenet.exe
    PID 544 wrote to memory of 1348544cmd.exenet.exe
    PID 1348 wrote to memory of 19281348net.exenet1.exe
    PID 1348 wrote to memory of 19281348net.exenet1.exe
    PID 1348 wrote to memory of 19281348net.exenet1.exe
    PID 1348 wrote to memory of 19281348net.exenet1.exe
    PID 1108 wrote to memory of 1972110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1972110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1972110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 1972110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1972 wrote to memory of 11161972cmd.exenet.exe
    PID 1972 wrote to memory of 11161972cmd.exenet.exe
    PID 1972 wrote to memory of 11161972cmd.exenet.exe
    PID 1972 wrote to memory of 11161972cmd.exenet.exe
    PID 1116 wrote to memory of 20441116net.exenet1.exe
    PID 1116 wrote to memory of 20441116net.exenet1.exe
    PID 1116 wrote to memory of 20441116net.exenet1.exe
    PID 1116 wrote to memory of 20441116net.exenet1.exe
    PID 1108 wrote to memory of 2032110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 2032110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 2032110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 1108 wrote to memory of 2032110895a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
Processes 32
  • C:\Users\Admin\AppData\Local\Temp\95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    "C:\Users\Admin\AppData\Local\Temp\95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe"
    Modifies extensions of user files
    Drops startup file
    Drops desktop.ini file(s)
    Drops file in System32 directory
    Drops file in Program Files directory
    Drops file in Windows directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLWriter
      Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Windows\SysWOW64\net.exe
        net stop SQLWriter
        Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLWriter
          PID:820
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLBrowser
      Suspicious use of WriteProcessMemory
      PID:1020
      • C:\Windows\SysWOW64\net.exe
        net stop SQLBrowser
        Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLBrowser
          PID:1468
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
      Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Windows\SysWOW64\net.exe
        net stop MSSQLSERVER
        Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSSQLSERVER
          PID:596
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
      Suspicious use of WriteProcessMemory
      PID:544
      • C:\Windows\SysWOW64\net.exe
        net stop MSSQL$CONTOSO1
        Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSSQL$CONTOSO1
          PID:1928
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSDTC
      Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\SysWOW64\net.exe
        net stop MSDTC
        Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSDTC
          PID:2044
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      PID:2032
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
      PID:112
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
      PID:1264
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
      PID:836
      • C:\Windows\SysWOW64\net.exe
        net stop SQLSERVERAGENT
        PID:1432
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLSERVERAGENT
          PID:1800
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
      PID:1384
      • C:\Windows\SysWOW64\net.exe
        net stop MSSQLSERVER
        PID:1276
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSSQLSERVER
          PID:1924
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop vds
      PID:1852
      • C:\Windows\SysWOW64\net.exe
        net stop vds
        PID:1232
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop vds
          PID:2024
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
      PID:2016
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall set currentprofile state off
        PID:1920
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
      PID:820
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall set opmode mode=disable
        PID:1964
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/1108-1-0x0000000001240000-0x0000000001251000-memory.dmp

                        • memory/1108-0-0x0000000000BB0000-0x0000000000BC1000-memory.dmp

                        • memory/1108-2-0x0000000000BB0000-0x0000000000BC1000-memory.dmp