Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

svchost_du...py.exe

windows7-x64

8

svchost_du...py.exe

windows10-1703-x64

8

svchost_du...py.exe

windows10-2004-x64

8

svchost_du...py.exe

windows11-21h2-x64

8

Resubmissions

12/04/2024, 13:32

240412-qtgfpsag84 8

12/04/2024, 13:32

240412-qtc4aaag83 8

12/04/2024, 13:32

240412-qtcshsag82 8

12/04/2024, 13:32

240412-qtb6zsag79 8

12/04/2024, 13:32

240412-qtbkfsdh4s 8

09/04/2024, 05:34

240409-f9mmjsbc9t 8

09/04/2024, 05:33

240409-f9bkaabc8w 8

09/04/2024, 05:33

240409-f86n2abc71 8

09/04/2024, 05:33

240409-f8wh3afh27 8

01/02/2024, 11:29

240201-nlq9tsebck 10

Analysis

  • max time kernel
    1799s
  • max time network
    1805s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/04/2024, 13:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost_dump_SCY - Copy.exe

  • Size

    5.2MB

  • MD5

    5fd3d21a968f4b8a1577b5405ab1c36a

  • SHA1

    710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

  • SHA256

    7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

  • SHA512

    085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

  • SSDEEP

    98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs

Score
8/10
discoveryevasion

Malware Config

Signatures

  • Contacts a large (751) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Windows Firewall 2 TTPs 26 IoCs
    evasion
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 20 IoCs
  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1388
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:2588
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:2600
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2540
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2712
    • C:\Windows\system32\schtasks.exe
      schtasks /delete /TN "Timer"
      2⤵
        PID:1284
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        2⤵
        • Creates scheduled task(s)
        PID:1280
      • C:\Windows\System\svchost.exe
        "C:\Windows\System\svchost.exe" formal
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:924
        • C:\Windows\System32\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          PID:2560
        • C:\Windows\System32\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          PID:1824
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2708
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:568
        • C:\Users\Admin\AppData\Local\Temp\~tlC1C9.tmp
          C:\Users\Admin\AppData\Local\Temp\~tlC1C9.tmp
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3036
          • C:\Windows\system32\netsh.exe
            netsh int ipv4 set dynamicport tcp start=1025 num=64511
            4⤵
              PID:2888
            • C:\Windows\System32\netsh.exe
              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:476
            • C:\Windows\System32\netsh.exe
              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:1332
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1684
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2740
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /TN "Timer"
              4⤵
                PID:240
              • C:\Windows\system32\schtasks.exe
                schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                4⤵
                • Creates scheduled task(s)
                PID:2064
              • C:\Windows\System\svchost.exe
                "C:\Windows\System\svchost.exe" formal
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                PID:1076
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  5⤵
                    PID:920
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    5⤵
                    • Modifies Windows Firewall
                    PID:872
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    5⤵
                    • Modifies Windows Firewall
                    PID:2200
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    5⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1608
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    5⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2812
                  • C:\Users\Admin\AppData\Local\Temp\~tl9BA3.tmp
                    C:\Users\Admin\AppData\Local\Temp\~tl9BA3.tmp
                    5⤵
                    • Executes dropped EXE
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2360
                    • C:\Windows\system32\netsh.exe
                      netsh int ipv4 set dynamicport tcp start=1025 num=64511
                      6⤵
                        PID:3016
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        6⤵
                        • Modifies Windows Firewall
                        PID:2584
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        6⤵
                        • Modifies Windows Firewall
                        PID:2448
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1156
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:804
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {AD15272E-6E1A-4545-AB30-D3989F5483DF} S-1-5-18:NT AUTHORITY\System:Service:
              1⤵
              • Loads dropped DLL
              PID:2416
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:2464
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  3⤵
                  • Modifies data under HKEY_USERS
                  PID:2424
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  3⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:2188
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  3⤵
                  • Modifies Windows Firewall
                  PID:2224
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                  3⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2512
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                  3⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2696
                • C:\Windows\TEMP\~tlBE60.tmp
                  C:\Windows\TEMP\~tlBE60.tmp
                  3⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2584
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:2236
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:1160
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:816
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1104
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2940
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {3FC433BE-E3A2-4A71-9592-1954BB8E66ED} S-1-5-18:NT AUTHORITY\System:Service:
              1⤵
              • Loads dropped DLL
              PID:2300
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:872
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  3⤵
                  • Modifies data under HKEY_USERS
                  PID:1956
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  3⤵
                  • Modifies Windows Firewall
                  PID:2880
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  3⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:1248
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                  3⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2580
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                  3⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1712
                • C:\Windows\TEMP\~tlFE4C.tmp
                  C:\Windows\TEMP\~tlFE4C.tmp
                  3⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2280
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    4⤵
                      PID:1904
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:1680
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:588
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1304
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1320
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {AD4F6672-7E36-4150-A13F-28596210849F} S-1-5-18:NT AUTHORITY\System:Service:
                1⤵
                • Loads dropped DLL
                PID:2536
                • \??\c:\windows\system\svchost.exe
                  c:\windows\system\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:908
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:2556
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                    • Modifies Windows Firewall
                    PID:2380
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                    • Modifies Windows Firewall
                    PID:1108
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2152
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1932
                  • C:\Windows\TEMP\~tl7253.tmp
                    C:\Windows\TEMP\~tl7253.tmp
                    3⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:576
                    • C:\Windows\system32\netsh.exe
                      netsh int ipv4 set dynamicport tcp start=1025 num=64511
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:1740
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:1804
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      PID:2896
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1908
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2636
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {F9F77FBB-1F56-41CD-A5AB-32F48D5D2EBD} S-1-5-18:NT AUTHORITY\System:Service:
                1⤵
                • Loads dropped DLL
                PID:2000
                • \??\c:\windows\system\svchost.exe
                  c:\windows\system\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2152
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    3⤵
                      PID:1600
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      3⤵
                      • Modifies Windows Firewall
                      PID:1680
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      3⤵
                      • Modifies Windows Firewall
                      PID:1104
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      3⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1320
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      3⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2412
                    • C:\Windows\TEMP\~tlD22E.tmp
                      C:\Windows\TEMP\~tlD22E.tmp
                      3⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2776
                      • C:\Windows\system32\netsh.exe
                        netsh int ipv4 set dynamicport tcp start=1025 num=64511
                        4⤵
                        • Modifies data under HKEY_USERS
                        PID:2432
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        4⤵
                        • Modifies Windows Firewall
                        • Modifies data under HKEY_USERS
                        PID:1284
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        4⤵
                        • Modifies Windows Firewall
                        • Modifies data under HKEY_USERS
                        PID:1868
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                        4⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2992
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                        4⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2116

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                  Filesize

                  68KB

                  MD5

                  29f65ba8e88c063813cc50a4ea544e93

                  SHA1

                  05a7040d5c127e68c25d81cc51271ffb8bef3568

                  SHA256

                  1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                  SHA512

                  e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                  Filesize

                  344B

                  MD5

                  74c66ff2cfbd8288b3d63ef66b1f2b64

                  SHA1

                  5a7582a161702f99acdacfc8778f9128eae2716c

                  SHA256

                  3bde6edd107d3a0508fbba0fcd09c81d625c32c72acd3060711889a2aa1813fb

                  SHA512

                  33f773b790dc983878dac29bd8dc869f4050f020a6f91c78280c2af0bc8c55d67e2786494fe201b2acc8cf03ea373bb222e01edecdb58d3148efaefffd5992c1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\TarD87C.tmp
                  Filesize

                  177KB

                  MD5

                  435a9ac180383f9fa094131b173a2f7b

                  SHA1

                  76944ea657a9db94f9a4bef38f88c46ed4166983

                  SHA256

                  67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                  SHA512

                  1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                  Filesize

                  7KB

                  MD5

                  b9558663828db83485b5a606bb1f1ab6

                  SHA1

                  e9728a743bd4e198ef8d020d3bd970418f4cfd65

                  SHA256

                  99154d0622c447046ba34ead9292063f0fec1d662b949ef2c3716b5cb026ae73

                  SHA512

                  eaf765fe740d46d38b06660742ac62163a815866b1587ad1d0790d036490cc3157b771deca1ec098f5d5e89ada8627426b6a584bcf41b5434c30b52ac6b23808

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                  Filesize

                  7KB

                  MD5

                  7f43d9fdf9552e9140c3fc7203b6ffc4

                  SHA1

                  43f556d949924debaec5cdab3d92ad5d3f724041

                  SHA256

                  845ee194936e30619c0113feff831e859afedee404a1c6272422e0c126e06f40

                  SHA512

                  4252cb097865f68f1b28859aa74b6015d95d193a8d2a1cf34fc2ad5b4826d78061d28de697edbe2a84f4d30602d8bcb9ad4334ffdc4aeb510a30afb8ae518013

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
                  Filesize

                  2.7MB

                  MD5

                  27acfbf94480631e547b5cb508d9d4fb

                  SHA1

                  f6477330ca9aeb4a8cd19cc44e1a30fa9695b36c

                  SHA256

                  0fd156526952ba5edb62133774a19bf72f71d3c968d01fcdb517521d45a67c5e

                  SHA512

                  902ccecfa284881c1f241802b9ccd51a85da0cc48632fbd944b686d37a4fa57bc7cd01c44ef79bfe475494be780164b82ff8fa9a3e77984f6e29467843138929

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                  Filesize

                  9.8MB

                  MD5

                  37502b9a9fe5b4558f745129ca5bb5a1

                  SHA1

                  45cb79551d1176e3a94ea5a71c2ddb0a29ad699c

                  SHA256

                  979084ea4af12b4ee8c899a0ab76869154bc8fb60d09598c3bde21c2c65d742d

                  SHA512

                  3d4daff15c1a2dcf28daa68270965ec5e21687dfc072881027f377e5dea701f6ba2ce32e67fc21175a4a4bf96acc0f26dd4d0b3c4ee4b160a0f78b58fd058fa7

                  Download Submit

                • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\output1[1].jpg
                  Filesize

                  393KB

                  MD5

                  72e28e2092a43e0d70289f62bec20e65

                  SHA1

                  944f2b81392ee946f4767376882c5c1bda6dddb5

                  SHA256

                  6ec8fe67dc01d8c3de9cfc94ca49ae25e46ed61f5a48f1a956ef269efa4ae08f

                  SHA512

                  31c0587cd1df4d63088973d72a015b144b64411031ac4c1904c54c4f43b5990b8016cc6d29e3b0238f86432005588c72b98806306918fdaf2786498de340e466

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\~tl9BA3.tmp
                  Filesize

                  393KB

                  MD5

                  9dbdd43a2e0b032604943c252eaf634a

                  SHA1

                  9584dc66f3c1cce4210fdf827a1b4e2bb22263af

                  SHA256

                  33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86

                  SHA512

                  b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\~tlC1C9.tmp
                  Filesize

                  385KB

                  MD5

                  e802c96760e48c5139995ffb2d891f90

                  SHA1

                  bba3d278c0eb1094a26e5d2f4c099ad685371578

                  SHA256

                  cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c

                  SHA512

                  97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0

                  Download Submit

                • \Windows\system\svchost.exe
                  Filesize

                  5.2MB

                  MD5

                  5fd3d21a968f4b8a1577b5405ab1c36a

                  SHA1

                  710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

                  SHA256

                  7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

                  SHA512

                  085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

                  Download Submit

                • memory/568-65-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/568-64-0x00000000029B0000-0x0000000002A30000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/568-60-0x00000000029B0000-0x0000000002A30000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/568-59-0x00000000029B0000-0x0000000002A30000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/568-58-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/568-56-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/568-55-0x00000000029B0000-0x0000000002A30000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/1076-162-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/1076-164-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/1076-202-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/1608-170-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

                  Filesize

                  2.9MB

                  Download

                • memory/1608-179-0x00000000025F0000-0x0000000002670000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/1608-181-0x00000000025F0000-0x0000000002670000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/1608-177-0x000007FEF4C30000-0x000007FEF55CD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/1608-178-0x0000000001C60000-0x0000000001C68000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/1608-180-0x000007FEF4C30000-0x000007FEF55CD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/1684-145-0x0000000002920000-0x00000000029A0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/1684-146-0x000007FEF4D40000-0x000007FEF56DD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/1684-143-0x0000000002920000-0x00000000029A0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/1684-130-0x000007FEF4D40000-0x000007FEF56DD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/1684-132-0x0000000002920000-0x00000000029A0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/1684-138-0x0000000002920000-0x00000000029A0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/1684-137-0x000007FEF4D40000-0x000007FEF56DD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/1684-131-0x0000000002290000-0x0000000002298000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2236-37-0x0000000140000000-0x0000000140636000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/2236-32-0x0000000037000000-0x0000000037636000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/2236-34-0x0000000037000000-0x0000000037636000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/2236-0-0x0000000140000000-0x0000000140636000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/2236-5-0x0000000140000000-0x0000000140636000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/2280-66-0x000000001ECB0000-0x000000001F192000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/2280-119-0x0000000140000000-0x0000000140636000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/2280-61-0x0000000140000000-0x0000000140636000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/2360-206-0x0000000140000000-0x0000000140170400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/2360-233-0x0000000140000000-0x0000000140170400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/2464-254-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/2464-282-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/2464-271-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/2540-21-0x0000000002790000-0x0000000002810000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2540-19-0x0000000002790000-0x0000000002810000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2540-24-0x000007FEF4B10000-0x000007FEF54AD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2540-15-0x000007FEF4B10000-0x000007FEF54AD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2540-14-0x0000000002790000-0x0000000002810000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2540-13-0x000007FEF4B10000-0x000007FEF54AD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2540-12-0x00000000024E0000-0x00000000024E8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2584-286-0x0000000140000000-0x0000000140170400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/2584-301-0x0000000140000000-0x0000000140170400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/2584-303-0x0000000140000000-0x0000000140170400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/2708-63-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2708-62-0x0000000002910000-0x0000000002990000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2708-43-0x000000001B300000-0x000000001B5E2000-memory.dmp

                  Filesize

                  2.9MB

                  Download

                • memory/2708-45-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2708-47-0x0000000002910000-0x0000000002990000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2708-57-0x0000000002910000-0x0000000002990000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2708-46-0x00000000022F0000-0x00000000022F8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2708-54-0x0000000002910000-0x0000000002990000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2708-53-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2712-16-0x0000000002500000-0x0000000002580000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2712-17-0x000007FEF4B10000-0x000007FEF54AD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2712-25-0x000007FEF4B10000-0x000007FEF54AD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2712-23-0x0000000002500000-0x0000000002580000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2712-18-0x0000000002500000-0x0000000002580000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2712-11-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

                  Filesize

                  2.9MB

                  Download

                • memory/2712-22-0x000007FEF4B10000-0x000007FEF54AD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2712-20-0x0000000002500000-0x0000000002580000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2740-141-0x0000000002270000-0x00000000022F0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2740-139-0x0000000002270000-0x00000000022F0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2740-142-0x0000000002270000-0x00000000022F0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2740-147-0x0000000002270000-0x00000000022F0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2740-148-0x000007FEF4D40000-0x000007FEF56DD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2740-144-0x000007FEF4D40000-0x000007FEF56DD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2740-140-0x000007FEF4D40000-0x000007FEF56DD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/2812-182-0x0000000002450000-0x00000000024D0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2812-184-0x0000000002450000-0x00000000024D0000-memory.dmp

                  Filesize

                  512KB

                  Download

                • memory/2812-183-0x000007FEF4C30000-0x000007FEF55CD000-memory.dmp

                  Filesize

                  9.6MB

                  Download

                • memory/3036-122-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/3036-121-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/3036-163-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/3036-120-0x0000000140000000-0x000000014015E400-memory.dmp

                  Filesize

                  1.4MB

                  Download