Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

tmp.exe

windows7-x64

8

tmp.exe

windows10-1703-x64

8

tmp.exe

windows10-2004-x64

8

tmp.exe

windows11-21h2-x64

1

Resubmissions

11/04/2024, 06:38

240411-hd63esha9z 8

11/04/2024, 06:37

240411-hdp4xaha9x 8

11/04/2024, 06:37

240411-hdlrgsha9w 8

11/04/2024, 06:37

240411-hdk5ysha9t 8

11/04/2024, 06:37

240411-hdkjesha9s 8

07/04/2024, 08:23

240407-kabhfsgg71 8

07/04/2024, 08:23

240407-j97t9shc64 8

07/04/2024, 08:22

240407-j93wbagg7w 8

07/04/2024, 08:22

240407-j9yatsgg7s 7

Analysis

  • max time kernel
    1800s
  • max time network
    1804s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/04/2024, 06:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    5.3MB

  • MD5

    5fe4ea367cee11e92ad4644d8ac3cef7

  • SHA1

    44faea4a352b7860a9eafca82bd3c9b054b6db29

  • SHA256

    1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b

  • SHA512

    1c4499eadaf44847a7a001c2622e558bc130c9ad608b4ec977480e002cf50c9eb36a65974b86a2db69e9bc43e7d239122389a6cf1ca2849c59bc137441fb0a4f

  • SSDEEP

    98304:lgU5484Bq1qdguoOzv4I3KOn6Ka1uFof9Hn6sdw5yOc4:iU54mqL9zvH3qO

Score
8/10
discoveryevasion

Malware Config

Signatures

  • Contacts a large (908) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Windows Firewall 2 TTPs 22 IoCs
    evasion
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 18 IoCs
  • Drops file in System32 directory 34 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2680
    • C:\Windows\system32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      2⤵
      • Creates scheduled task(s)
      PID:1676
    • C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1936
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
      • C:\Users\Admin\AppData\Local\Temp\~tlB654.tmp
        C:\Users\Admin\AppData\Local\Temp\~tlB654.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Windows\system32\netsh.exe
          netsh int ipv4 set dynamicport tcp start=1025 num=64511
          4⤵
            PID:2620
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1096
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1548
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2572
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2196
          • C:\Windows\system32\schtasks.exe
            schtasks /delete /TN "Timer"
            4⤵
              PID:932
            • C:\Windows\system32\schtasks.exe
              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
              4⤵
              • Creates scheduled task(s)
              PID:600
            • C:\Windows\System\svchost.exe
              "C:\Windows\System\svchost.exe" formal
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1764
              • C:\Windows\system32\netsh.exe
                netsh int ipv4 set dynamicport tcp start=1025 num=64511
                5⤵
                  PID:2236
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  5⤵
                  • Modifies Windows Firewall
                  PID:2772
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  5⤵
                  • Modifies Windows Firewall
                  PID:1332
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:944
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1848
                • C:\Users\Admin\AppData\Local\Temp\~tl8A84.tmp
                  C:\Users\Admin\AppData\Local\Temp\~tl8A84.tmp
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1688
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    6⤵
                      PID:1708
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:1952
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:2596
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2888
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2824
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {A8CF0453-BDA2-4174-8CC3-48044FFFA90D} S-1-5-18:NT AUTHORITY\System:Service:
            1⤵
            • Loads dropped DLL
            PID:1428
            • \??\c:\windows\system\svchost.exe
              c:\windows\system\svchost.exe
              2⤵
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              PID:1976
              • C:\Windows\system32\netsh.exe
                netsh int ipv4 set dynamicport tcp start=1025 num=64511
                3⤵
                • Modifies data under HKEY_USERS
                PID:2736
              • C:\Windows\System32\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                3⤵
                • Modifies Windows Firewall
                • Modifies data under HKEY_USERS
                PID:2520
              • C:\Windows\System32\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                3⤵
                • Modifies Windows Firewall
                • Modifies data under HKEY_USERS
                PID:760
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                3⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2280
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                3⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2840
              • C:\Windows\TEMP\~tlC497.tmp
                C:\Windows\TEMP\~tlC497.tmp
                3⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:2116
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  4⤵
                    PID:2084
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:2728
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    PID:2068
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2908
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:188
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {6F9025C2-E3D0-4500-A577-CB75E335E43B} S-1-5-18:NT AUTHORITY\System:Service:
              1⤵
              • Loads dropped DLL
              PID:1724
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:1672
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  3⤵
                  • Modifies data under HKEY_USERS
                  PID:2584
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  3⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:2752
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  3⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:1932
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                  3⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:984
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                  3⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1640
                • C:\Windows\TEMP\~tl27AD.tmp
                  C:\Windows\TEMP\~tl27AD.tmp
                  3⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:680
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:2296
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:1076
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    PID:2944
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2892
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2268
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {A78905E1-F2C1-425E-9045-FB45ABDEB19A} S-1-5-18:NT AUTHORITY\System:Service:
              1⤵
              • Loads dropped DLL
              PID:3028
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:2156
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  3⤵
                    PID:2512
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:2616
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                    • Modifies Windows Firewall
                    PID:2752
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:896
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2740
                  • C:\Windows\TEMP\~tl8872.tmp
                    C:\Windows\TEMP\~tl8872.tmp
                    3⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1040
                    • C:\Windows\system32\netsh.exe
                      netsh int ipv4 set dynamicport tcp start=1025 num=64511
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:3040
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:1272
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      PID:1304
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1240
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:956
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {4E801733-F4C3-4A86-9F66-E3C23D363BA5} S-1-5-18:NT AUTHORITY\System:Service:
                1⤵
                • Loads dropped DLL
                PID:984
                • \??\c:\windows\system\svchost.exe
                  c:\windows\system\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2576
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    3⤵
                      PID:2188
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      3⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:1964
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      3⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:2488
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      3⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:784
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      3⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1764
                    • C:\Windows\TEMP\~tlF374.tmp
                      C:\Windows\TEMP\~tlF374.tmp
                      3⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      PID:768
                      • C:\Windows\system32\netsh.exe
                        netsh int ipv4 set dynamicport tcp start=1025 num=64511
                        4⤵
                          PID:1340
                        • C:\Windows\System32\netsh.exe
                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                          4⤵
                          • Modifies Windows Firewall
                          • Modifies data under HKEY_USERS
                          PID:2812
                        • C:\Windows\System32\netsh.exe
                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                          4⤵
                          • Modifies Windows Firewall
                          PID:2300
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                          4⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:564
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                          4⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2756

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\~tlB654.tmp
                    Filesize

                    385KB

                    MD5

                    e802c96760e48c5139995ffb2d891f90

                    SHA1

                    bba3d278c0eb1094a26e5d2f4c099ad685371578

                    SHA256

                    cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c

                    SHA512

                    97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                    Filesize

                    7KB

                    MD5

                    79c0f2ca28045a0416a8751003722634

                    SHA1

                    306b7e40ee8e1179261200d0fe25da8ad8d27eb0

                    SHA256

                    d26331ec6336d76f27a2a68670f227ce881d42872d71f0fb9c2fbb5d8bf3829e

                    SHA512

                    64c2a381d56febac4909d7fb4bbd53bb07acaae0cfd4e78f34a7a0619421751d68ebfda51ce618c1d314698f3d56cdb9d62d3f8c8f9d3d5bb084ac397fca4d2d

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                    Filesize

                    7KB

                    MD5

                    532e3293f4831d714726ba918196fb56

                    SHA1

                    dd6cc3de7e4f31f4e2049d3313282c2edd88c520

                    SHA256

                    079afd3cb6e44429aed61a12bd59900437b85b0e0e9cfdea5c50bf68cdcf69fa

                    SHA512

                    b198b9c7ea191dd78390b74af87d053caffd75ea50d9385af4d632cf46e28f12f0bd2335806ebca67874ae223e7713952f84cfd6e030d51dbfa62378c463b931

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
                    Filesize

                    2.7MB

                    MD5

                    c9b1dde253446b4b2bc6a0ad4d3022c2

                    SHA1

                    66cf356f3717f3d07a1c568c7146f9f9f14adf9f

                    SHA256

                    4fcc265cafab726d5e03b652e7b3fb4681a28f0dc5349825fe28b5413c96d3f3

                    SHA512

                    0e8f41766a67cea5d48950d0f30b5c5e1c6b7e9a5d77515e2be72d719c11bed624991c8764c7edddb0981dffd34fbd6e6e89d9ac9bd65164a14b27f21a2ce005

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                    Filesize

                    10.0MB

                    MD5

                    ad0eb392e9fd04121978c64ef7dc182b

                    SHA1

                    cdee2d532f81b60b3212a1533980decaaa450318

                    SHA256

                    12a2813e1b1f16ae20af3e195f2eb281edc547271ffd2f18603d25434f3d5dca

                    SHA512

                    b677cb29c38eb4d992b9872afbb6959f45028efadcd336efc8260d644974435f9287a07b6649f854f2671f3b25d6937e5e258646f5c3bde04fc93aa15e2aab3b

                    Download Submit

                  • C:\Windows\System\svchost.exe
                    Filesize

                    385KB

                    MD5

                    8d246d330df3fedfeab23b5e21cd140e

                    SHA1

                    9b394909bdc5f35af3f5350554ce5d9ed74fc2d0

                    SHA256

                    1f12992ea4a5877c960c361751f052c42f16fe0677172d03802320f4403f561f

                    SHA512

                    a257699518273737a14a41b9cb016bc1a516e133ed8ee4adf84dc1fdeaa909e7b95e91f1650363d866fa778110f7f8059e0573028eac2450e063fdeeb36722f6

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\~tl8A84.tmp
                    Filesize

                    393KB

                    MD5

                    9dbdd43a2e0b032604943c252eaf634a

                    SHA1

                    9584dc66f3c1cce4210fdf827a1b4e2bb22263af

                    SHA256

                    33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86

                    SHA512

                    b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1

                    Download Submit

                  • \Windows\system\svchost.exe
                    Filesize

                    5.3MB

                    MD5

                    5fe4ea367cee11e92ad4644d8ac3cef7

                    SHA1

                    44faea4a352b7860a9eafca82bd3c9b054b6db29

                    SHA256

                    1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b

                    SHA512

                    1c4499eadaf44847a7a001c2622e558bc130c9ad608b4ec977480e002cf50c9eb36a65974b86a2db69e9bc43e7d239122389a6cf1ca2849c59bc137441fb0a4f

                    Download Submit

                  • memory/944-188-0x0000000002490000-0x0000000002510000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/944-181-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/944-182-0x0000000002490000-0x0000000002510000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/944-184-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1688-205-0x0000000140000000-0x0000000140170400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1688-233-0x0000000140000000-0x0000000140170400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1688-207-0x0000000140000000-0x0000000140170400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1764-204-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1764-170-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1764-167-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1764-168-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1848-183-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1848-187-0x0000000002BA0000-0x0000000002C20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1848-185-0x0000000002BA0000-0x0000000002C20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1848-186-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1936-61-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1936-62-0x0000000001EE0000-0x0000000001F60000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1936-69-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1936-66-0x0000000001EE0000-0x0000000001F60000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1936-63-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1936-65-0x0000000001EE4000-0x0000000001EE7000-memory.dmp

                    Filesize

                    12KB

                    Download

                  • memory/1964-16-0x0000000002290000-0x0000000002298000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/1964-24-0x00000000026A0000-0x0000000002720000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1964-17-0x00000000026A0000-0x0000000002720000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1964-15-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1964-27-0x00000000026A0000-0x0000000002720000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1964-30-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1964-18-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1964-22-0x00000000026A0000-0x0000000002720000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1964-14-0x000000001B300000-0x000000001B5E2000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/1976-313-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1976-259-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1976-295-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2116-336-0x0000000140000000-0x0000000140170400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2116-352-0x0000000140000000-0x0000000140170400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2116-354-0x0000000140000000-0x0000000140170400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2196-151-0x00000000029A0000-0x0000000002A20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2196-144-0x00000000029A0000-0x0000000002A20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2196-153-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2196-146-0x00000000029A0000-0x0000000002A20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2196-148-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2196-149-0x00000000029A0000-0x0000000002A20000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2196-145-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2200-68-0x000000000251B000-0x0000000002582000-memory.dmp

                    Filesize

                    412KB

                    Download

                  • memory/2200-52-0x0000000002460000-0x0000000002468000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2200-50-0x000000001B330000-0x000000001B612000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/2200-57-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2200-58-0x0000000002510000-0x0000000002590000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2200-59-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2200-60-0x0000000002510000-0x0000000002590000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2200-64-0x0000000002514000-0x0000000002517000-memory.dmp

                    Filesize

                    12KB

                    Download

                  • memory/2200-67-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2488-125-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2488-126-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2488-169-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2488-124-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2572-147-0x0000000002610000-0x0000000002690000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2572-138-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2572-152-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2572-143-0x0000000002610000-0x0000000002690000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2572-134-0x00000000024F0000-0x00000000024F8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2572-150-0x0000000002610000-0x0000000002690000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2572-133-0x000007FEF53F0000-0x000007FEF5D8D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2572-132-0x000000001B230000-0x000000001B512000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/2572-135-0x0000000002610000-0x0000000002690000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2584-42-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2584-123-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2584-44-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2584-70-0x0000000040410000-0x000000004090C000-memory.dmp

                    Filesize

                    5.0MB

                    Download

                  • memory/2680-20-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2680-19-0x00000000023E0000-0x0000000002460000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2680-29-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2680-28-0x00000000023E0000-0x0000000002460000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2680-25-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2680-21-0x00000000023E0000-0x0000000002460000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2680-23-0x00000000023E0000-0x0000000002460000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2744-40-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2744-0-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2744-4-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2744-2-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2744-3-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2744-1-0x0000000140000000-0x0000000140645400-memory.dmp

                    Filesize

                    6.3MB

                    Download