Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

64e589ec7b...ab.exe

windows11-21h2-x64

1

64e589ec7b...ab.exe

windows7-x64

8

64e589ec7b...ab.exe

windows10-1703-x64

8

64e589ec7b...ab.exe

windows10-2004-x64

8

64e589ec7b...ab.exe

windows11-21h2-x64

1

Resubmissions

17/04/2024, 12:37

240417-pths4afc45 8

17/04/2024, 12:37

240417-ptg7kafc43 8

17/04/2024, 12:36

240417-ptcbbafc34 8

17/04/2024, 12:36

240417-ptbpsafc29 8

17/04/2024, 12:36

240417-pta39afc28 8

16/04/2024, 13:44

240416-q1vxnsda7z 8

Analysis

  • max time kernel
    1800s
  • max time network
    1800s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 12:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    64e589ec7bd006671b3192241c36ab7d87c9f4e93fd0b0d6f5f327de1b9a59ab.exe

  • Size

    5.3MB

  • MD5

    63552c60caeefe5f2d0e4028b3cc65d3

  • SHA1

    dbed3040d53495a6afda01bfb8399376792eb48c

  • SHA256

    64e589ec7bd006671b3192241c36ab7d87c9f4e93fd0b0d6f5f327de1b9a59ab

  • SHA512

    caf92a581afd25daaf9763a382b47fc87141773a8879c24ed855dfe1186b86ed7269b0cf17e8c1caee983eb85008f1161f4df07aabe0e1bb719514b41c365ba0

  • SSDEEP

    98304:vwrOjNr08jQxkFg97Nw76XgfqCPa1AQy2cmw:YC5r0wQxKg97Nw76XgyC6

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 22 IoCs
    evasion
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 20 IoCs
  • Drops file in System32 directory 37 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\64e589ec7bd006671b3192241c36ab7d87c9f4e93fd0b0d6f5f327de1b9a59ab.exe
    "C:\Users\Admin\AppData\Local\Temp\64e589ec7bd006671b3192241c36ab7d87c9f4e93fd0b0d6f5f327de1b9a59ab.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2592
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2584
    • C:\Windows\system32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      2⤵
      • Creates scheduled task(s)
      PID:2308
    • C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1616
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1276
      • C:\Users\Admin\AppData\Local\Temp\~tl3A52.tmp
        C:\Users\Admin\AppData\Local\Temp\~tl3A52.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1432
        • C:\Windows\system32\netsh.exe
          netsh int ipv4 set dynamicport tcp start=1025 num=64511
          4⤵
            PID:2412
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:2388
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:2692
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2756
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2852
          • C:\Windows\system32\schtasks.exe
            schtasks /delete /TN "Timer"
            4⤵
              PID:288
            • C:\Windows\system32\schtasks.exe
              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
              4⤵
              • Creates scheduled task(s)
              PID:468
            • C:\Windows\System\svchost.exe
              "C:\Windows\System\svchost.exe" formal
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1520
              • C:\Windows\system32\netsh.exe
                netsh int ipv4 set dynamicport tcp start=1025 num=64511
                5⤵
                  PID:1964
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  5⤵
                  • Modifies Windows Firewall
                  PID:2884
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  5⤵
                  • Modifies Windows Firewall
                  PID:1944
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:576
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3040
                • C:\Users\Admin\AppData\Local\Temp\~tl1FA1.tmp
                  C:\Users\Admin\AppData\Local\Temp\~tl1FA1.tmp
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:956
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    6⤵
                      PID:2172
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:2228
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:1512
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1360
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2664
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {72C765B7-2AB4-4EC5-99AB-9B6B732BB80F} S-1-5-18:NT AUTHORITY\System:Service:
            1⤵
            • Loads dropped DLL
            PID:1068
            • \??\c:\windows\system\svchost.exe
              c:\windows\system\svchost.exe
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              PID:1896
              • C:\Windows\system32\netsh.exe
                netsh int ipv4 set dynamicport tcp start=1025 num=64511
                3⤵
                • Modifies data under HKEY_USERS
                PID:1540
              • C:\Windows\System32\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                3⤵
                • Modifies Windows Firewall
                • Modifies data under HKEY_USERS
                PID:1924
              • C:\Windows\System32\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                3⤵
                • Modifies Windows Firewall
                PID:2768
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                3⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1668
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                3⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1664
              • C:\Windows\TEMP\~tl37F2.tmp
                C:\Windows\TEMP\~tl37F2.tmp
                3⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:2492
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  4⤵
                    PID:396
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    PID:1608
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:2388
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2064
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2508
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {2830E962-2B7C-4752-89E5-8366B036000F} S-1-5-18:NT AUTHORITY\System:Service:
              1⤵
              • Loads dropped DLL
              PID:2596
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:2064
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  3⤵
                    PID:2424
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                    • Modifies Windows Firewall
                    PID:2888
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                    • Modifies Windows Firewall
                    PID:2032
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:604
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1468
                  • C:\Windows\TEMP\~tlB3C5.tmp
                    C:\Windows\TEMP\~tlB3C5.tmp
                    3⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2004
                    • C:\Windows\system32\netsh.exe
                      netsh int ipv4 set dynamicport tcp start=1025 num=64511
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:3020
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:2068
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      PID:1540
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2548
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2732
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {70AA5A3C-85F9-457C-B57C-C542BA1EAEAE} S-1-5-18:NT AUTHORITY\System:Service:
                1⤵
                • Loads dropped DLL
                PID:2232
                • \??\c:\windows\system\svchost.exe
                  c:\windows\system\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:628
                  • C:\Windows\system32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    3⤵
                      PID:2308
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      3⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:1748
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      3⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:1184
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      3⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2552
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      3⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2344
                    • C:\Windows\TEMP\~tl2195.tmp
                      C:\Windows\TEMP\~tl2195.tmp
                      3⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2840
                      • C:\Windows\system32\netsh.exe
                        netsh int ipv4 set dynamicport tcp start=1025 num=64511
                        4⤵
                        • Modifies data under HKEY_USERS
                        PID:2748
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        4⤵
                        • Modifies Windows Firewall
                        • Modifies data under HKEY_USERS
                        PID:2888
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        4⤵
                        • Modifies Windows Firewall
                        • Modifies data under HKEY_USERS
                        PID:1316
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                        4⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2592
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                        4⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2544
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {53BC6322-9334-4B45-99DB-E3E597467BCE} S-1-5-18:NT AUTHORITY\System:Service:
                  1⤵
                  • Loads dropped DLL
                  PID:1132
                  • \??\c:\windows\system\svchost.exe
                    c:\windows\system\svchost.exe
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1944
                    • C:\Windows\system32\netsh.exe
                      netsh int ipv4 set dynamicport tcp start=1025 num=64511
                      3⤵
                        PID:2384
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        3⤵
                        • Modifies Windows Firewall
                        • Modifies data under HKEY_USERS
                        PID:2064
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        3⤵
                        • Modifies Windows Firewall
                        PID:2000
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                        3⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1460
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                        3⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1540
                      • C:\Windows\TEMP\~tl83E0.tmp
                        C:\Windows\TEMP\~tl83E0.tmp
                        3⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1984
                        • C:\Windows\system32\netsh.exe
                          netsh int ipv4 set dynamicport tcp start=1025 num=64511
                          4⤵
                          • Modifies data under HKEY_USERS
                          PID:2488
                        • C:\Windows\System32\netsh.exe
                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                          4⤵
                          • Modifies Windows Firewall
                          PID:2904
                        • C:\Windows\System32\netsh.exe
                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                          4⤵
                          • Modifies Windows Firewall
                          • Modifies data under HKEY_USERS
                          PID:2568
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                          4⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2516
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                          4⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2024

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                    Filesize

                    7KB

                    MD5

                    9ea9a6e671395304eb71f94f3bc50350

                    SHA1

                    d88220d50d4b0f8ff96bad67aaf611734f58163c

                    SHA256

                    09b9c4290e25ff1297e18b6010bb4c8d6b77c9dcdddbcc0d56063c870cbfec26

                    SHA512

                    7eaf6d02e06bb98fa205779d6d7cec42cbe9ec58aaad1034d26890393409a7998424db70508068fdf75026730af9bfde267d96e4d7ecc1e504242e421dc18f41

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                    Filesize

                    7KB

                    MD5

                    990e6c550565407780abb5b978581ace

                    SHA1

                    7834738866f407279c4d76763cef0e8a41f621e9

                    SHA256

                    8f4ebd7cb6b55e7491a6b4a4218377dc75e7736fd602cd7dbbf074adfb7b3d2d

                    SHA512

                    7265a6b27ab8388ff37de5651cd2b108776a5bf2ce898ccbdc0074cff2244747f4a3934f603b13ca31659806696786a88f6d9f7cbdf5d1cefb00e17c8240ebbf

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
                    Filesize

                    2.6MB

                    MD5

                    e7634067c1219da664e2c13a622988bf

                    SHA1

                    b354b3912ec59fefecdaa660af50c679b136b6ca

                    SHA256

                    e1f51b61149b811c5029caaa39ddf54faa18fcd18bbcf432155ad324fbc0fdb7

                    SHA512

                    b61ea1448ec13e88c66e043c0f99d95a2626e631841bec0b0e2e1dd6cbbcb8f8587d414f3ad32794ccdadf7c763910ed844220684f3edc71109f47fe4353c944

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                    Filesize

                    19.0MB

                    MD5

                    a6c8b5dc4561fd52c5cca9ec47248f53

                    SHA1

                    b09e0e8151c0f69ec134a4e87325560dbbc3aa90

                    SHA256

                    cf2304a5c5a51446b06da56d52ab570abbb343bf307ae29199181a0377a234dd

                    SHA512

                    f8b98bdd387cdc9116da0807c08c37ed69bee57d243e7fc0f1a3824a9480ca8049cb6c007b96efc80f63a376023e554d8368e72a4ce10f74b205e6019bcdddd0

                    Download Submit

                  • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\output1[1].jpg
                    Filesize

                    393KB

                    MD5

                    72e28e2092a43e0d70289f62bec20e65

                    SHA1

                    944f2b81392ee946f4767376882c5c1bda6dddb5

                    SHA256

                    6ec8fe67dc01d8c3de9cfc94ca49ae25e46ed61f5a48f1a956ef269efa4ae08f

                    SHA512

                    31c0587cd1df4d63088973d72a015b144b64411031ac4c1904c54c4f43b5990b8016cc6d29e3b0238f86432005588c72b98806306918fdaf2786498de340e466

                    Download Submit

                  • C:\Windows\system\svchost.exe
                    Filesize

                    5.3MB

                    MD5

                    63552c60caeefe5f2d0e4028b3cc65d3

                    SHA1

                    dbed3040d53495a6afda01bfb8399376792eb48c

                    SHA256

                    64e589ec7bd006671b3192241c36ab7d87c9f4e93fd0b0d6f5f327de1b9a59ab

                    SHA512

                    caf92a581afd25daaf9763a382b47fc87141773a8879c24ed855dfe1186b86ed7269b0cf17e8c1caee983eb85008f1161f4df07aabe0e1bb719514b41c365ba0

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\~tl1FA1.tmp
                    Filesize

                    393KB

                    MD5

                    9dbdd43a2e0b032604943c252eaf634a

                    SHA1

                    9584dc66f3c1cce4210fdf827a1b4e2bb22263af

                    SHA256

                    33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86

                    SHA512

                    b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\~tl3A52.tmp
                    Filesize

                    385KB

                    MD5

                    e802c96760e48c5139995ffb2d891f90

                    SHA1

                    bba3d278c0eb1094a26e5d2f4c099ad685371578

                    SHA256

                    cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c

                    SHA512

                    97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0

                    Download Submit

                  • memory/576-189-0x0000000002C90000-0x0000000002D10000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/576-187-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/576-186-0x000000001B600000-0x000000001B8E2000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/576-190-0x0000000002C90000-0x0000000002D10000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/576-188-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/576-196-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/628-314-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/956-215-0x0000000140000000-0x0000000140170400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1276-72-0x00000000022E4000-0x00000000022E7000-memory.dmp

                    Filesize

                    12KB

                    Download

                  • memory/1276-66-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1276-75-0x00000000022EB000-0x0000000002352000-memory.dmp

                    Filesize

                    412KB

                    Download

                  • memory/1276-65-0x00000000022E0000-0x0000000002360000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1276-74-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1276-62-0x00000000022C0000-0x00000000022C8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/1276-68-0x00000000022E0000-0x0000000002360000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1276-63-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1432-136-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1432-137-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1432-138-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1432-179-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1512-49-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1512-91-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1512-125-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1512-126-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1512-76-0x000000001A400000-0x000000001A8FC000-memory.dmp

                    Filesize

                    5.0MB

                    Download

                  • memory/1512-135-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1520-178-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1520-214-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1520-180-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1520-206-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1616-71-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1616-73-0x0000000002DB0000-0x0000000002E30000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1616-67-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1616-70-0x0000000002DB0000-0x0000000002E30000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1616-69-0x0000000002DB0000-0x0000000002E30000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1616-60-0x000000001B760000-0x000000001BA42000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/1616-64-0x0000000002DB0000-0x0000000002E30000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1616-93-0x0000000002DB0000-0x0000000002E30000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/1616-61-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1728-0-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1728-43-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1728-5-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1728-3-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1728-6-0x0000000140000000-0x0000000140644400-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/1896-258-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/1944-343-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2064-285-0x0000000140000000-0x000000014015E400-memory.dmp

                    Filesize

                    1.4MB

                    Download

                  • memory/2584-24-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2584-31-0x00000000026B0000-0x0000000002730000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2584-21-0x00000000026B0000-0x0000000002730000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2584-29-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2584-27-0x00000000026B4000-0x00000000026B7000-memory.dmp

                    Filesize

                    12KB

                    Download

                  • memory/2584-26-0x00000000026B0000-0x0000000002730000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2584-20-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2584-45-0x00000000026B0000-0x0000000002730000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2584-17-0x00000000026A0000-0x00000000026A8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2592-30-0x0000000002C54000-0x0000000002C57000-memory.dmp

                    Filesize

                    12KB

                    Download

                  • memory/2592-22-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2592-19-0x0000000002C50000-0x0000000002CD0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2592-23-0x0000000002C5B000-0x0000000002CC2000-memory.dmp

                    Filesize

                    412KB

                    Download

                  • memory/2592-25-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2592-16-0x000000001B6A0000-0x000000001B982000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/2592-18-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2592-28-0x0000000002C50000-0x0000000002CD0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2756-149-0x00000000029C0000-0x0000000002A40000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2756-147-0x00000000029C0000-0x0000000002A40000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2756-146-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2756-145-0x000000001B680000-0x000000001B962000-memory.dmp

                    Filesize

                    2.9MB

                    Download

                  • memory/2756-148-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2756-161-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2756-151-0x00000000029C0000-0x0000000002A40000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2756-150-0x00000000029C0000-0x0000000002A40000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2852-163-0x0000000002830000-0x00000000028B0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2852-159-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2852-162-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2852-164-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/2852-160-0x0000000002830000-0x00000000028B0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/2852-158-0x0000000002830000-0x00000000028B0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/3040-199-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/3040-201-0x0000000002670000-0x00000000026F0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/3040-200-0x0000000002670000-0x00000000026F0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/3040-198-0x0000000002670000-0x00000000026F0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/3040-197-0x000007FEF4E80000-0x000007FEF581D000-memory.dmp

                    Filesize

                    9.6MB

                    Download