2ffc5d7602a7c79b149f2dc4fe9d4ae8f1e38bf8ebc5a07029451871e243de10

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dde43cdcb278b5fe4d8970da4fb31cf.exe
Size

93KB
MD5

1dde43cdcb278b5fe4d8970da4fb31cf
SHA1

98d8bdf90eda8545e6674033932af4443cf072ac
SHA256

2ffc5d7602a7c79b149f2dc4fe9d4ae8f1e38bf8ebc5a07029451871e243de10
SHA512

f199cce436129133bcdb39aca5ecf393a7fadc0a10bc38978dad94c3a41429299b49973796edeffb8b016182ca1c213ec1f175085c381adaa807190d6287f27a
SSDEEP

1536:N+RnEoSnsqS5ut9YDR8SjEwzGi1dDeDVgS:N+tSnsqS5uTYD+7i1dwi

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 64 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
900	netsh.exe
2932	netsh.exe
1432	netsh.exe
2784	netsh.exe
844	netsh.exe
1796	netsh.exe
752	netsh.exe
1496	netsh.exe
1444	netsh.exe
1244	netsh.exe
2940	netsh.exe
1416	netsh.exe
2904	netsh.exe
2064	netsh.exe
2884	netsh.exe
1444	netsh.exe
828	netsh.exe
2140	netsh.exe
2548	netsh.exe
2768	netsh.exe
2948	netsh.exe
2136	netsh.exe
580	netsh.exe
2692	netsh.exe
1632	netsh.exe
308	netsh.exe
2560	netsh.exe
2640	netsh.exe
272	netsh.exe
3068	netsh.exe
1540	netsh.exe
1476	netsh.exe
1848	netsh.exe
1640	netsh.exe
604	netsh.exe
1572	netsh.exe
1256	netsh.exe
1180	netsh.exe
2636	netsh.exe
760	netsh.exe
2528	netsh.exe
828	netsh.exe
1356	netsh.exe
584	netsh.exe
2732	netsh.exe
1020	netsh.exe
1236	netsh.exe
1356	netsh.exe
608	netsh.exe
604	netsh.exe
1144	netsh.exe
316	netsh.exe
2368	netsh.exe
340	netsh.exe
2040	netsh.exe
1560	netsh.exe
2148	netsh.exe
3064	netsh.exe
2136	netsh.exe
1580	netsh.exe
1272	netsh.exe
1208	netsh.exe
1052	netsh.exe
1500	netsh.exe

Drops startup file 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8654a281c9f4fdd6b7fb66d728ad2a41Windows Update.exe	server.exe

Executes dropped EXE 64 IoCs

pid	Process
2636	server.exe
2132	svchost.exe
2044	server.exe
2236	svchost.exe
1304	server.exe
656	svchost.exe
2388	server.exe
2716	svchost.exe
2504	server.exe
1248	svchost.exe
2292	server.exe
484	svchost.exe
2280	server.exe
2072	svchost.exe
852	server.exe
1636	svchost.exe
2604	server.exe
2784	svchost.exe
2116	server.exe
2184	svchost.exe
2292	server.exe
2416	svchost.exe
1700	server.exe
1888	svchost.exe
2388	server.exe
2040	svchost.exe
2508	server.exe
2384	svchost.exe
1844	server.exe
2208	svchost.exe
1236	server.exe
2016	svchost.exe
2684	server.exe
2584	svchost.exe
2488	server.exe
2640	svchost.exe
2564	server.exe
1704	svchost.exe
760	server.exe
604	svchost.exe
1504	server.exe
900	svchost.exe
2536	server.exe
2792	svchost.exe
2592	server.exe
1444	svchost.exe
2200	server.exe
2248	svchost.exe
1236	server.exe
2396	svchost.exe
1888	server.exe
2956	svchost.exe
2540	server.exe
2508	svchost.exe
1248	server.exe
612	svchost.exe
1216	server.exe
2148	svchost.exe
580	server.exe
2768	svchost.exe
2132	server.exe
1884	svchost.exe
2904	server.exe
2980	svchost.exe

Loads dropped DLL 64 IoCs

pid	Process
2636	server.exe
2636	server.exe
2044	server.exe
2044	server.exe
1304	server.exe
1304	server.exe
2388	server.exe
2388	server.exe
2504	server.exe
2504	server.exe
2292	server.exe
2292	server.exe
2280	server.exe
2280	server.exe
852	server.exe
852	server.exe
2604	server.exe
2604	server.exe
2116	server.exe
2116	server.exe
2292	server.exe
2292	server.exe
1700	server.exe
1700	server.exe
2388	server.exe
2388	server.exe
2508	server.exe
2508	server.exe
1844	server.exe
1844	server.exe
1236	server.exe
1236	server.exe
2684	server.exe
2684	server.exe
2488	server.exe
2488	server.exe
2564	server.exe
2564	server.exe
760	server.exe
760	server.exe
1504	server.exe
1504	server.exe
2536	server.exe
2536	server.exe
2592	server.exe
2592	server.exe
2200	server.exe
2200	server.exe
1236	server.exe
1236	server.exe
1888	server.exe
1888	server.exe
2540	server.exe
2540	server.exe
1248	server.exe
1248	server.exe
1216	server.exe
1216	server.exe
580	server.exe
580	server.exe
2132	server.exe
2132	server.exe
2904	server.exe
2904	server.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\autorun.inf	server.exe
File opened for modification	F:\autorun.inf	server.exe
File created	C:\autorun.inf	server.exe
File opened for modification	C:\autorun.inf	server.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe
File created	C:\Windows\server.exe	svchost.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File opened for modification	C:\Windows\server.exe	server.exe
File created	C:\Windows\server.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe
2636	server.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	server.exe
Token: SeDebugPrivilege	2044	server.exe
Token: SeDebugPrivilege	1304	server.exe
Token: SeDebugPrivilege	2388	server.exe
Token: SeDebugPrivilege	2504	server.exe
Token: SeDebugPrivilege	2292	server.exe
Token: SeDebugPrivilege	2280	server.exe
Token: SeDebugPrivilege	852	server.exe
Token: SeDebugPrivilege	2604	server.exe
Token: SeDebugPrivilege	2116	server.exe
Token: SeDebugPrivilege	2292	server.exe
Token: SeDebugPrivilege	1700	server.exe
Token: SeDebugPrivilege	2388	server.exe
Token: SeDebugPrivilege	2508	server.exe
Token: SeDebugPrivilege	1844	server.exe
Token: SeDebugPrivilege	1236	server.exe
Token: SeDebugPrivilege	2684	server.exe
Token: SeDebugPrivilege	2488	server.exe
Token: SeDebugPrivilege	2564	server.exe
Token: SeDebugPrivilege	760	server.exe
Token: SeDebugPrivilege	1504	server.exe
Token: SeDebugPrivilege	2536	server.exe
Token: SeDebugPrivilege	2592	server.exe
Token: SeDebugPrivilege	2200	server.exe
Token: SeDebugPrivilege	1236	server.exe
Token: SeDebugPrivilege	1888	server.exe
Token: SeDebugPrivilege	2540	server.exe
Token: SeDebugPrivilege	1248	server.exe
Token: SeDebugPrivilege	1216	server.exe
Token: SeDebugPrivilege	580	server.exe
Token: SeDebugPrivilege	2132	server.exe
Token: SeDebugPrivilege	2904	server.exe
Token: SeDebugPrivilege	2180	server.exe
Token: SeDebugPrivilege	848	server.exe
Token: SeDebugPrivilege	2708	server.exe
Token: SeDebugPrivilege	624	server.exe
Token: SeDebugPrivilege	2096	server.exe
Token: SeDebugPrivilege	2084	server.exe
Token: SeDebugPrivilege	1304	server.exe
Token: SeDebugPrivilege	1912	server.exe
Token: SeDebugPrivilege	836	server.exe
Token: SeDebugPrivilege	1824	server.exe
Token: SeDebugPrivilege	344	server.exe
Token: SeDebugPrivilege	988	server.exe
Token: SeDebugPrivilege	3064	server.exe
Token: SeDebugPrivilege	608	server.exe
Token: SeDebugPrivilege	2600	server.exe
Token: SeDebugPrivilege	2108	server.exe
Token: SeDebugPrivilege	2452	server.exe
Token: SeDebugPrivilege	1916	server.exe
Token: SeDebugPrivilege	324	server.exe
Token: SeDebugPrivilege	1708	server.exe
Token: SeDebugPrivilege	2552	server.exe
Token: SeDebugPrivilege	624	server.exe
Token: SeDebugPrivilege	2660	server.exe
Token: SeDebugPrivilege	2996	server.exe
Token: SeDebugPrivilege	2692	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2636	2424	1dde43cdcb278b5fe4d8970da4fb31cf.exe	28
PID 2424 wrote to memory of 2636	2424	1dde43cdcb278b5fe4d8970da4fb31cf.exe	28
PID 2424 wrote to memory of 2636	2424	1dde43cdcb278b5fe4d8970da4fb31cf.exe	28
PID 2424 wrote to memory of 2636	2424	1dde43cdcb278b5fe4d8970da4fb31cf.exe	28
PID 2636 wrote to memory of 2672	2636	server.exe	29
PID 2636 wrote to memory of 2672	2636	server.exe	29
PID 2636 wrote to memory of 2672	2636	server.exe	29
PID 2636 wrote to memory of 2672	2636	server.exe	29
PID 2636 wrote to memory of 2564	2636	server.exe	31
PID 2636 wrote to memory of 2564	2636	server.exe	31
PID 2636 wrote to memory of 2564	2636	server.exe	31
PID 2636 wrote to memory of 2564	2636	server.exe	31
PID 2636 wrote to memory of 2612	2636	server.exe	32
PID 2636 wrote to memory of 2612	2636	server.exe	32
PID 2636 wrote to memory of 2612	2636	server.exe	32
PID 2636 wrote to memory of 2612	2636	server.exe	32
PID 2636 wrote to memory of 2132	2636	server.exe	35
PID 2636 wrote to memory of 2132	2636	server.exe	35
PID 2636 wrote to memory of 2132	2636	server.exe	35
PID 2636 wrote to memory of 2132	2636	server.exe	35
PID 2132 wrote to memory of 2044	2132	svchost.exe	36
PID 2132 wrote to memory of 2044	2132	svchost.exe	36
PID 2132 wrote to memory of 2044	2132	svchost.exe	36
PID 2132 wrote to memory of 2044	2132	svchost.exe	36
PID 2044 wrote to memory of 1884	2044	server.exe	37
PID 2044 wrote to memory of 1884	2044	server.exe	37
PID 2044 wrote to memory of 1884	2044	server.exe	37
PID 2044 wrote to memory of 1884	2044	server.exe	37
PID 2044 wrote to memory of 1040	2044	server.exe	39
PID 2044 wrote to memory of 1040	2044	server.exe	39
PID 2044 wrote to memory of 1040	2044	server.exe	39
PID 2044 wrote to memory of 1040	2044	server.exe	39
PID 2044 wrote to memory of 1032	2044	server.exe	40
PID 2044 wrote to memory of 1032	2044	server.exe	40
PID 2044 wrote to memory of 1032	2044	server.exe	40
PID 2044 wrote to memory of 1032	2044	server.exe	40
PID 2044 wrote to memory of 2236	2044	server.exe	43
PID 2044 wrote to memory of 2236	2044	server.exe	43
PID 2044 wrote to memory of 2236	2044	server.exe	43
PID 2044 wrote to memory of 2236	2044	server.exe	43
PID 2236 wrote to memory of 1304	2236	svchost.exe	44
PID 2236 wrote to memory of 1304	2236	svchost.exe	44
PID 2236 wrote to memory of 1304	2236	svchost.exe	44
PID 2236 wrote to memory of 1304	2236	svchost.exe	44
PID 1304 wrote to memory of 2372	1304	server.exe	45
PID 1304 wrote to memory of 2372	1304	server.exe	45
PID 1304 wrote to memory of 2372	1304	server.exe	45
PID 1304 wrote to memory of 2372	1304	server.exe	45
PID 1304 wrote to memory of 1180	1304	server.exe	47
PID 1304 wrote to memory of 1180	1304	server.exe	47
PID 1304 wrote to memory of 1180	1304	server.exe	47
PID 1304 wrote to memory of 1180	1304	server.exe	47
PID 1304 wrote to memory of 2368	1304	server.exe	48
PID 1304 wrote to memory of 2368	1304	server.exe	48
PID 1304 wrote to memory of 2368	1304	server.exe	48
PID 1304 wrote to memory of 2368	1304	server.exe	48
PID 1304 wrote to memory of 656	1304	server.exe	49
PID 1304 wrote to memory of 656	1304	server.exe	49
PID 1304 wrote to memory of 656	1304	server.exe	49
PID 1304 wrote to memory of 656	1304	server.exe	49
PID 656 wrote to memory of 2388	656	svchost.exe	52
PID 656 wrote to memory of 2388	656	svchost.exe	52
PID 656 wrote to memory of 2388	656	svchost.exe	52
PID 656 wrote to memory of 2388	656	svchost.exe	52

C:\Users\Admin\AppData\Local\Temp\1dde43cdcb278b5fe4d8970da4fb31cf.exe
"C:\Users\Admin\AppData\Local\Temp\1dde43cdcb278b5fe4d8970da4fb31cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\server.exe
  "C:\Windows\server.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops autorun.inf file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Windows\server.exe"
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\server.exe
      "C:\Windows\server.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        5⤵
        
        PID:1884
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        5⤵
        
        PID:1040
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2236
      - C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        7⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        7⤵
        Modifies Windows Firewall
        
        PID:1180
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        
        PID:2368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        8⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        9⤵
        Modifies Windows Firewall
        
        PID:2136
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        9⤵
        Modifies Windows Firewall
        
        PID:1640
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        9⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        9⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        11⤵
        Modifies Windows Firewall
        
        PID:2560
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        11⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        11⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1248
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        12⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        13⤵
        Modifies Windows Firewall
        
        PID:2904
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        13⤵
        Modifies Windows Firewall
        
        PID:1356
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        13⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        13⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:484
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        14⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        15⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        15⤵
        Modifies Windows Firewall
        
        PID:828
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        15⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        15⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        16⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:852
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        17⤵
        
        PID:884
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        17⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        17⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        17⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        18⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        19⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        19⤵
        Modifies Windows Firewall
        
        PID:2640
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        19⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        19⤵
        Executes dropped EXE
        
        PID:2784
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        20⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        21⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        21⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        21⤵
        Modifies Windows Firewall
        
        PID:1020
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        21⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2184
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        22⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        23⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        23⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        23⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        23⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        24⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        25⤵
        Modifies Windows Firewall
        
        PID:608
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        25⤵
        
        PID:944
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        25⤵
        Modifies Windows Firewall
        
        PID:900
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        25⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        27⤵
        Modifies Windows Firewall
        
        PID:2064
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        27⤵
        Modifies Windows Firewall
        
        PID:2932
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        27⤵
        Modifies Windows Firewall
        
        PID:2692
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        27⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2040
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        29⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        29⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        29⤵
        Modifies Windows Firewall
        
        PID:2636
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        29⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2384
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1844
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        31⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        31⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        31⤵
        Modifies Windows Firewall
        
        PID:760
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        31⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2208
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        32⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        33⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        33⤵
        Modifies Windows Firewall
        
        PID:272
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        33⤵
        Modifies Windows Firewall
        
        PID:1580
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        33⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2016
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        34⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        35⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        35⤵
        Modifies Windows Firewall
        
        PID:1432
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        35⤵
        Modifies Windows Firewall
        
        PID:1560
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        35⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        36⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        37⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        37⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        37⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        37⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2640
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        38⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        39⤵
        Modifies Windows Firewall
        
        PID:2528
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        39⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        39⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        39⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:760
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        41⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        41⤵
        
        PID:448
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        41⤵
        Modifies Windows Firewall
        
        PID:340
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        41⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:604
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        42⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        43⤵
        Modifies Windows Firewall
        
        PID:752
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        43⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        43⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        43⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:900
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        44⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        45⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        45⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        45⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        45⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        46⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        47⤵
        Modifies Windows Firewall
        
        PID:1272
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        47⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        47⤵
        Modifies Windows Firewall
        
        PID:1208
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        47⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1444
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        48⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        49⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        49⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        49⤵
        Modifies Windows Firewall
        
        PID:828
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        49⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        51⤵
        Modifies Windows Firewall
        
        PID:3068
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        51⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        51⤵
        Modifies Windows Firewall
        
        PID:1496
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        51⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        52⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        53⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        53⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        53⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        53⤵
        Executes dropped EXE
        
        PID:2956
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        54⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2540
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        55⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        55⤵
        Modifies Windows Firewall
        
        PID:1356
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        55⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        55⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        56⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        57⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        57⤵
        Modifies Windows Firewall
        
        PID:2140
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        57⤵
        Modifies Windows Firewall
        
        PID:1540
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        57⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:612
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        58⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        59⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        59⤵
        Modifies Windows Firewall
        
        PID:604
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        59⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        59⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2148
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        60⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        61⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        61⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        61⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        61⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2768
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        62⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        63⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        63⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        63⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        63⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        64⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        65⤵
        
        PID:484
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        65⤵
        Modifies Windows Firewall
        
        PID:1444
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        65⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        65⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        66⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        67⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        67⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        67⤵
        Modifies Windows Firewall
        
        PID:2784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        67⤵
        Drops file in Windows directory
        
        PID:1960
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        68⤵
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:848
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        69⤵
        
        PID:288
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        69⤵
        Modifies Windows Firewall
        
        PID:2148
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        69⤵
        Modifies Windows Firewall
        
        PID:1052
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        69⤵
        Drops file in Windows directory
        
        PID:2924
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        70⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        71⤵
        Modifies Windows Firewall
        
        PID:2548
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        71⤵
        Modifies Windows Firewall
        
        PID:2768
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        71⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        71⤵
        
        PID:2452
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        72⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        73⤵
        Modifies Windows Firewall
        
        PID:3064
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        73⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        73⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        73⤵
        Drops file in Windows directory
        
        PID:2636
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        74⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        75⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        75⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        75⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        75⤵
        
        PID:448
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        76⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        77⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        77⤵
        Modifies Windows Firewall
        
        PID:604
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        77⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        77⤵
        Drops file in Windows directory
        
        PID:1600
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        78⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        79⤵
        Modifies Windows Firewall
        
        PID:1632
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        79⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        79⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        79⤵
        Drops file in Windows directory
        
        PID:2856
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        80⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        81⤵
        Modifies Windows Firewall
        
        PID:1244
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        81⤵
        Modifies Windows Firewall
        
        PID:2884
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        81⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        81⤵
        Drops file in Windows directory
        
        PID:1032
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        82⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        83⤵
        Modifies Windows Firewall
        
        PID:1144
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        83⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        83⤵
        Modifies Windows Firewall
        
        PID:2948
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        83⤵
        Drops file in Windows directory
        
        PID:284
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        84⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        85⤵
        
        PID:828
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        85⤵
        Modifies Windows Firewall
        
        PID:1500
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        85⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        85⤵
        Drops file in Windows directory
        
        PID:2232
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        86⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:344
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        87⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        87⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        87⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        87⤵
        
        PID:852
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        88⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        89⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        89⤵
        Modifies Windows Firewall
        
        PID:2040
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        89⤵
        Modifies Windows Firewall
        
        PID:1476
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        89⤵
        Drops file in Windows directory
        
        PID:2008
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        90⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        91⤵
        Modifies Windows Firewall
        
        PID:584
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        91⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        91⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        91⤵
        Drops file in Windows directory
        
        PID:1732
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        92⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:608
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        93⤵
        Modifies Windows Firewall
        
        PID:1444
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        93⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        93⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        93⤵
        Drops file in Windows directory
        
        PID:3060
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        94⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        95⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        95⤵
        Modifies Windows Firewall
        
        PID:1236
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        95⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        95⤵
        Drops file in Windows directory
        
        PID:604
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        96⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        97⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        97⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        97⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        97⤵
        Drops file in Windows directory
        
        PID:1348
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        98⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        99⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        99⤵
        Modifies Windows Firewall
        
        PID:2732
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        99⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        99⤵
        
        PID:2676
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        100⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        101⤵
        Modifies Windows Firewall
        
        PID:1848
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        101⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        101⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        101⤵
        Drops file in Windows directory
        
        PID:484
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        102⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        103⤵
        Modifies Windows Firewall
        
        PID:2940
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        103⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        103⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        103⤵
        
        PID:1588
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        104⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        105⤵
        
        PID:876
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        105⤵
        Modifies Windows Firewall
        
        PID:2136
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        105⤵
        Modifies Windows Firewall
        
        PID:316
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        105⤵
        Drops file in Windows directory
        
        PID:2120
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        106⤵
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        107⤵
        
        PID:852
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        107⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        107⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        107⤵
        Drops file in Windows directory
        
        PID:940
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        108⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        109⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        109⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        109⤵
        Modifies Windows Firewall
        
        PID:844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        109⤵
        
        PID:352
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        110⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        111⤵
        Modifies Windows Firewall
        
        PID:1572
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        111⤵
        Modifies Windows Firewall
        
        PID:308
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        111⤵
        Modifies Windows Firewall
        
        PID:1416
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        111⤵
        Drops file in Windows directory
        
        PID:1956
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        112⤵
        Drops startup file
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        113⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        113⤵
        Modifies Windows Firewall
        
        PID:1256
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        113⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        113⤵
        
        PID:1180
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        114⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        115⤵
        Modifies Windows Firewall
        
        PID:580
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        115⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        115⤵
        Modifies Windows Firewall
        
        PID:1796
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        115⤵
        Drops file in Windows directory
        
        PID:2672
        
        C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        116⤵
        
        PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\melt.txt

Filesize
21B

MD5
28e4dd4093f543ce9c85dc38111b8e4d

SHA1
8607d0131f30e6246088ae3e3aeb58b6405fb65e

SHA256
0944e1d01a6e4926eb610353fb63f4ec70c3cc91dd03a49f90a256b67da9c3d1

SHA512
10e4e647856e37ad280acf3b283095f73fd5ccb40bf38cfa2a7e0040970efc39c553f30d2b06da1c55004a6a02145db36d032356fdabc2f533a9df52052d7ea3

Download Submit
C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
8f11404a507cfb98455f89a534077f73

SHA1
0716c668f504450353527aff1a6457b8348cf435

SHA256
f7c301f3fcce1c2444b540090e5024f0cea1806ab8ae1d81901ecc3b63334cbb

SHA512
85403dd06da5851e8c4d727ca8d87cc0e7ff4974942ec22123366684ed0e51b543a29b6d2521e2e65784c69884fde8d711e5064f104b098293fcd18c44769492

Download Submit
C:\Windows\server.exe

Filesize
93KB

MD5
1dde43cdcb278b5fe4d8970da4fb31cf

SHA1
98d8bdf90eda8545e6674033932af4443cf072ac

SHA256
2ffc5d7602a7c79b149f2dc4fe9d4ae8f1e38bf8ebc5a07029451871e243de10

SHA512
f199cce436129133bcdb39aca5ecf393a7fadc0a10bc38978dad94c3a41429299b49973796edeffb8b016182ca1c213ec1f175085c381adaa807190d6287f27a

Download Submit
memory/2424-0-0x00000000740C1000-0x00000000740C2000-memory.dmp

Filesize
4KB

Download
memory/2424-1-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-2-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-12-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2636-13-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2636-14-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2636-15-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2636-47-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download