Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 03:01

General

  • Target

    2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc.exe

  • Size

    143KB

  • MD5

    69630b02c7ffc7b4da96fb005506b581

  • SHA1

    d4f899e98af3f7ff5354261deebfbe1d7d8dc68c

  • SHA256

    2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc

  • SHA512

    ff121fb2ca0efb040ca78fa8664292380037104b2e3a306464a7e92ac696918edec937abec7b2de6bb49545c03c9af4bf587677513b064c0307623a72c770661

  • SSDEEP

    3072:vyD3IvFC1QrEWP70rlqy0TwJU94x+ZR5XIf7o0p:wHRWT0rlhWqoHIf7F

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 28 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc.exe
    "C:\Users\Admin\AppData\Local\Temp\2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Users\Admin\AppData\Local\Temp\2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc.exe
      "C:\Users\Admin\AppData\Local\Temp\2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc.exe"71
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Users\Admin\koomnd\dnmook.exe
        "C:\Users\Admin\koomnd\dnmook.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Users\Admin\koomnd\dnmook.exe
          "C:\Users\Admin\koomnd\dnmook.exe" 71
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Checks computer location settings
          • Drops startup file
          • Adds Run key to start application
          • Maps connected drives based on registry
          • Drops autorun.inf file
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2700
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c route add 216.239.32.21 10.127.0.254
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4876
            • C:\Windows\SysWOW64\ROUTE.EXE
              route add 216.239.32.21 10.127.0.254
              6⤵
                PID:380
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c route add 216.239.34.21 10.127.0.254
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1656
              • C:\Windows\SysWOW64\ROUTE.EXE
                route add 216.239.34.21 10.127.0.254
                6⤵
                  PID:3412
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c route add 216.239.36.21 10.127.0.254
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2776
                • C:\Windows\SysWOW64\ROUTE.EXE
                  route add 216.239.36.21 10.127.0.254
                  6⤵
                    PID:4636
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c route add 216.239.38.21 10.127.0.254
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3132
                  • C:\Windows\SysWOW64\ROUTE.EXE
                    route add 216.239.38.21 10.127.0.254
                    6⤵
                      PID:2008
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c route add 74.125.34.46 10.127.0.254
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1080
                    • C:\Windows\SysWOW64\ROUTE.EXE
                      route add 74.125.34.46 10.127.0.254
                      6⤵
                        PID:1536
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c route add 173.194.72.121 10.127.0.254
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1880
                      • C:\Windows\SysWOW64\ROUTE.EXE
                        route add 173.194.72.121 10.127.0.254
                        6⤵
                          PID:1684
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c route add 5.39.93.201 10.127.0.254
                        5⤵
                          PID:3032
                          • C:\Windows\SysWOW64\ROUTE.EXE
                            route add 5.39.93.201 10.127.0.254
                            6⤵
                              PID:3492
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c route add 207.46.0.0/16 10.127.0.254
                            5⤵
                              PID:1596
                              • C:\Windows\SysWOW64\ROUTE.EXE
                                route add 207.46.0.0/16 10.127.0.254
                                6⤵
                                  PID:4356
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c route add 65.52.0.0/14 10.127.0.254
                                5⤵
                                  PID:2088
                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                    route add 65.52.0.0/14 10.127.0.254
                                    6⤵
                                      PID:3344
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c route add 157.54.0.0/15 10.127.0.254
                                    5⤵
                                      PID:4204
                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                        route add 157.54.0.0/15 10.127.0.254
                                        6⤵
                                          PID:1072
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c route add 157.56.0.0/14 10.127.0.254
                                        5⤵
                                          PID:752
                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                            route add 157.56.0.0/14 10.127.0.254
                                            6⤵
                                              PID:4900
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c route add 157.60.0.0/16 10.127.0.254
                                            5⤵
                                              PID:3176
                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                route add 157.60.0.0/16 10.127.0.254
                                                6⤵
                                                  PID:776
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c route add 134.170.0.0/16 10.127.0.254
                                                5⤵
                                                  PID:4004
                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                    route add 134.170.0.0/16 10.127.0.254
                                                    6⤵
                                                      PID:4492
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c route add 72.32.67.100 10.127.0.254
                                                    5⤵
                                                      PID:2872
                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                        route add 72.32.67.100 10.127.0.254
                                                        6⤵
                                                          PID:2364
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c route add 91.228.166.0/24 10.127.0.254
                                                        5⤵
                                                          PID:2724
                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                            route add 91.228.166.0/24 10.127.0.254
                                                            6⤵
                                                              PID:3288
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c route add 91.228.167.0/24 10.127.0.254
                                                            5⤵
                                                              PID:3020
                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                route add 91.228.167.0/24 10.127.0.254
                                                                6⤵
                                                                  PID:2076
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c route add 37.187.68.0/24 10.127.0.254
                                                                5⤵
                                                                  PID:4176
                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                    route add 37.187.68.0/24 10.127.0.254
                                                                    6⤵
                                                                      PID:4248
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c route add 46.4.58.0/24 10.127.0.254
                                                                    5⤵
                                                                      PID:1396
                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                        route add 46.4.58.0/24 10.127.0.254
                                                                        6⤵
                                                                          PID:4208
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c route add 46.4.62.0/24 10.127.0.254
                                                                        5⤵
                                                                          PID:4996
                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                            route add 46.4.62.0/24 10.127.0.254
                                                                            6⤵
                                                                              PID:1976
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c route add 46.4.66.0/24 10.127.0.254
                                                                            5⤵
                                                                              PID:3972
                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                route add 46.4.66.0/24 10.127.0.254
                                                                                6⤵
                                                                                  PID:1192
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c route add 46.4.67.0/24 10.127.0.254
                                                                                5⤵
                                                                                  PID:3124
                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                    route add 46.4.67.0/24 10.127.0.254
                                                                                    6⤵
                                                                                      PID:3900
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c route add 46.165.210.0/24 10.127.0.254
                                                                                    5⤵
                                                                                      PID:4652
                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                        route add 46.165.210.0/24 10.127.0.254
                                                                                        6⤵
                                                                                          PID:4596
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c route add 50.7.73.0/24 10.127.0.254
                                                                                        5⤵
                                                                                          PID:4264
                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                            route add 50.7.73.0/24 10.127.0.254
                                                                                            6⤵
                                                                                              PID:3864
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c route add 50.7.100.0/24 10.127.0.254
                                                                                            5⤵
                                                                                              PID:2544
                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                route add 50.7.100.0/24 10.127.0.254
                                                                                                6⤵
                                                                                                  PID:4380
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c route add 50.115.125.0/24 10.127.0.254
                                                                                                5⤵
                                                                                                  PID:4296
                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                    route add 50.115.125.0/24 10.127.0.254
                                                                                                    6⤵
                                                                                                      PID:3840
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 67.15.0.0/24 10.127.0.254
                                                                                                    5⤵
                                                                                                      PID:4276
                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                        route add 67.15.0.0/24 10.127.0.254
                                                                                                        6⤵
                                                                                                          PID:2428
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 67.228.112.0/24 10.127.0.254
                                                                                                        5⤵
                                                                                                          PID:1080
                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                            route add 67.228.112.0/24 10.127.0.254
                                                                                                            6⤵
                                                                                                              PID:884
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 74.86.245.0/24 10.127.0.254
                                                                                                            5⤵
                                                                                                              PID:2548
                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                route add 74.86.245.0/24 10.127.0.254
                                                                                                                6⤵
                                                                                                                  PID:1768
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 75.126.120.0/24 10.127.0.254
                                                                                                                5⤵
                                                                                                                  PID:2044
                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                    route add 75.126.120.0/24 10.127.0.254
                                                                                                                    6⤵
                                                                                                                      PID:1836
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 77.234.41.0/24 10.127.0.254
                                                                                                                    5⤵
                                                                                                                      PID:1300
                                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                        route add 77.234.41.0/24 10.127.0.254
                                                                                                                        6⤵
                                                                                                                          PID:2664
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 77.234.43.0/24 10.127.0.254
                                                                                                                        5⤵
                                                                                                                          PID:3348
                                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                            route add 77.234.43.0/24 10.127.0.254
                                                                                                                            6⤵
                                                                                                                              PID:4204
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 77.234.44.0/24 10.127.0.254
                                                                                                                            5⤵
                                                                                                                              PID:2124
                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                route add 77.234.44.0/24 10.127.0.254
                                                                                                                                6⤵
                                                                                                                                  PID:4076
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 91.213.143.0/24 10.127.0.254
                                                                                                                                5⤵
                                                                                                                                  PID:1432
                                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                    route add 91.213.143.0/24 10.127.0.254
                                                                                                                                    6⤵
                                                                                                                                      PID:2412
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 95.211.196.0/24 10.127.0.254
                                                                                                                                    5⤵
                                                                                                                                      PID:4556
                                                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                        route add 95.211.196.0/24 10.127.0.254
                                                                                                                                        6⤵
                                                                                                                                          PID:5052
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 109.123.114.0/24 10.127.0.254
                                                                                                                                        5⤵
                                                                                                                                          PID:4784
                                                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                            route add 109.123.114.0/24 10.127.0.254
                                                                                                                                            6⤵
                                                                                                                                              PID:1112
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 109.123.117.0/24 10.127.0.254
                                                                                                                                            5⤵
                                                                                                                                              PID:4344
                                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                route add 109.123.117.0/24 10.127.0.254
                                                                                                                                                6⤵
                                                                                                                                                  PID:3288
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 199.115.116.0/24 10.127.0.254
                                                                                                                                                5⤵
                                                                                                                                                  PID:1068
                                                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                    route add 199.115.116.0/24 10.127.0.254
                                                                                                                                                    6⤵
                                                                                                                                                      PID:4644
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 173.193.20.0/24 10.127.0.254
                                                                                                                                                    5⤵
                                                                                                                                                      PID:1344
                                                                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                        route add 173.193.20.0/24 10.127.0.254
                                                                                                                                                        6⤵
                                                                                                                                                          PID:4632
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 173.193.138.0/24 10.127.0.254
                                                                                                                                                        5⤵
                                                                                                                                                          PID:3560
                                                                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                            route add 173.193.138.0/24 10.127.0.254
                                                                                                                                                            6⤵
                                                                                                                                                              PID:4044
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 173.193.216.0/24 10.127.0.254
                                                                                                                                                            5⤵
                                                                                                                                                              PID:4684
                                                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                route add 173.193.216.0/24 10.127.0.254
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:2200
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 174.37.222.0/24 10.127.0.254
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:60
                                                                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                    route add 174.37.222.0/24 10.127.0.254
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:2348
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 174.36.55.0/24 10.127.0.254
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:2468
                                                                                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                        route add 174.36.55.0/24 10.127.0.254
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:3788
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 174.36.237.0/24 10.127.0.254
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:2220
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:3972
                                                                                                                                                                            • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                              route add 174.36.237.0/24 10.127.0.254
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:4780
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c route add 199.115.116.0/24 10.127.0.254
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:2172
                                                                                                                                                                                • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                  route add 199.115.116.0/24 10.127.0.254
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:4520
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c route add 208.43.71.0/24 10.127.0.254
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:4364
                                                                                                                                                                                    • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                      route add 208.43.71.0/24 10.127.0.254
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:3864
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c route add 208.53.149.0/24 10.127.0.254
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2584
                                                                                                                                                                                        • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                          route add 208.53.149.0/24 10.127.0.254
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:2324
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c route add 216.185.103.0/24 10.127.0.254
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:3984
                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:4380
                                                                                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                route add 216.185.103.0/24 10.127.0.254
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:3840
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 4.28.136.0/24 10.127.0.254
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                    route add 4.28.136.0/24 10.127.0.254
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 38.124.168.0/24 10.127.0.254
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:400
                                                                                                                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                        route add 38.124.168.0/24 10.127.0.254
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:932
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 38.117.98.0/24 10.127.0.254
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                            route add 38.117.98.0/24 10.127.0.254
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 77.74.183.0/24 10.127.0.254
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                route add 77.74.183.0/24 10.127.0.254
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:3516
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 80.239.169.0/24 10.127.0.254
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:4032
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:2548
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                      route add 80.239.169.0/24 10.127.0.254
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:1816
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c route add 80.239.174.0/24 10.127.0.254
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:2044
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                            route add 80.239.174.0/24 10.127.0.254
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 80.239.197.0/24 10.127.0.254
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                route add 80.239.197.0/24 10.127.0.254
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 85.12.58.0/24 10.127.0.254
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:732
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                    route add 85.12.58.0/24 10.127.0.254
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:4340
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 85.17.72.0/24 10.127.0.254
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                        route add 85.17.72.0/24 10.127.0.254
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 93.159.230.0/24 10.127.0.254
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2232
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                            route add 93.159.230.0/24 10.127.0.254
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:5052
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 94.75.236.0/24 10.127.0.254
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                route add 94.75.236.0/24 10.127.0.254
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:4556
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 93.191.13.0/24 10.127.0.254
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:916
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                    route add 93.191.13.0/24 10.127.0.254
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:1984
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 95.167.139.0/24 10.127.0.254
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:2092
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                        route add 95.167.139.0/24 10.127.0.254
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:4852
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 95.211.85.0/24 10.127.0.254
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:3552
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                            route add 95.211.85.0/24 10.127.0.254
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 195.16.117.0/24 10.127.0.254
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:4476
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                                route add 195.16.117.0/24 10.127.0.254
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:4288
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 195.122.169.0/24 10.127.0.254
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                                    route add 195.122.169.0/24 10.127.0.254
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:2272
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c route add 130.117.190.0/24 10.127.0.254
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:1532
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                                        route add 130.117.190.0/24 10.127.0.254
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:4756
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c route add 144.140.113.0/24 10.127.0.254
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:3924
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                                            route add 144.140.113.0/24 10.127.0.254
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c route add 212.73.221.0/24 10.127.0.254
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:820
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                                                route add 212.73.221.0/24 10.127.0.254
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c route add 125.39.66.0/24 10.127.0.254
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                                                                                                                                                                                                                                                                    route add 125.39.66.0/24 10.127.0.254
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:3900
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\PhotoScreensaver.scr
                                                                                                                                                                                                                                                                                "C:\Windows\System32\PhotoScreensaver.scr" /S
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:4540

                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                            • C:\Users\Admin\koomnd\dnmook.exe

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              143KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              69630b02c7ffc7b4da96fb005506b581

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              d4f899e98af3f7ff5354261deebfbe1d7d8dc68c

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              ff121fb2ca0efb040ca78fa8664292380037104b2e3a306464a7e92ac696918edec937abec7b2de6bb49545c03c9af4bf587677513b064c0307623a72c770661

                                                                                                                                                                                                                                                                            • C:\Users\Admin\koomnd\dnmook.exe

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              143KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              69630b02c7ffc7b4da96fb005506b581

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              d4f899e98af3f7ff5354261deebfbe1d7d8dc68c

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              ff121fb2ca0efb040ca78fa8664292380037104b2e3a306464a7e92ac696918edec937abec7b2de6bb49545c03c9af4bf587677513b064c0307623a72c770661

                                                                                                                                                                                                                                                                            • C:\Users\Admin\koomnd\dnmook.exe

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              143KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              69630b02c7ffc7b4da96fb005506b581

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              d4f899e98af3f7ff5354261deebfbe1d7d8dc68c

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              2f31ca2dca469afba2108a2a3d6767a6ec9ff6677387bb72dd10c44a2ac38ffc

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              ff121fb2ca0efb040ca78fa8664292380037104b2e3a306464a7e92ac696918edec937abec7b2de6bb49545c03c9af4bf587677513b064c0307623a72c770661

                                                                                                                                                                                                                                                                            • memory/2700-156-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                                            • memory/3452-141-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                                            • memory/3452-137-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                                            • memory/3452-140-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                                            • memory/3452-135-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              92KB