Overview

overview

10

Static

static

10

5c4a70d8d2...0N.exe

windows7-x64

10

5c4a70d8d2...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2024, 03:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5c4a70d8d23b8305cddc270ce8763240N.exe
  • Size 93KB
  • Sample240717-dtldfatdlr
  • SHA256 8887919fe07f6127f8842a8ef02d2c3c8e964046a6d5f41640e3811f520ec9db
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
evasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 64 IoCs
    evasion
  • Checks computer location settings 2 TTPs 43 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 64 IoCs
  • Executes dropped EXE 43 IoCs
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c4a70d8d23b8305cddc270ce8763240N.exe
    "C:\Users\Admin\AppData\Local\Temp\5c4a70d8d23b8305cddc270ce8763240N.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\server.exe
      "C:\Windows\server.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3952
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall delete allowedprogram "C:\Windows\server.exe"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3592
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:880
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Windows\server.exe
          "C:\Windows\server.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5052
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:868
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall delete allowedprogram "C:\Windows\server.exe"
            5⤵
            • Modifies Windows Firewall
            PID:1040
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:5088
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4840
            • C:\Windows\server.exe
              "C:\Windows\server.exe"
              6⤵
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2676
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:2440
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall delete allowedprogram "C:\Windows\server.exe"
                7⤵
                • Modifies Windows Firewall
                PID:1716
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:3508
              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4232
                • C:\Windows\server.exe
                  "C:\Windows\server.exe"
                  8⤵
                  • Checks computer location settings
                  • Drops startup file
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1408
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                    9⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:3884
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall delete allowedprogram "C:\Windows\server.exe"
                    9⤵
                    • Modifies Windows Firewall
                    PID:3976
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                    9⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:2280
                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5052
                    • C:\Windows\server.exe
                      "C:\Windows\server.exe"
                      10⤵
                      • Checks computer location settings
                      • Drops startup file
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2996
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                        11⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:1696
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall delete allowedprogram "C:\Windows\server.exe"
                        11⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:2460
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                        11⤵
                        • Modifies Windows Firewall
                        PID:3252
                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:1872
                        • C:\Windows\server.exe
                          "C:\Windows\server.exe"
                          12⤵
                          • Checks computer location settings
                          • Drops startup file
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3904
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                            13⤵
                            • Modifies Windows Firewall
                            PID:456
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall delete allowedprogram "C:\Windows\server.exe"
                            13⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:4004
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                            13⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:2516
                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            PID:2964
                            • C:\Windows\server.exe
                              "C:\Windows\server.exe"
                              14⤵
                              • Checks computer location settings
                              • Drops startup file
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Program Files directory
                              • Drops file in Windows directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5096
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                15⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                PID:2352
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                15⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                PID:4248
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                15⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                PID:3196
                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                PID:2124
                                • C:\Windows\server.exe
                                  "C:\Windows\server.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Drops file in Program Files directory
                                  • Drops file in Windows directory
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3856
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                    17⤵
                                    • Modifies Windows Firewall
                                    PID:1884
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                    17⤵
                                    • Modifies Windows Firewall
                                    PID:3592
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                    17⤵
                                    • Modifies Windows Firewall
                                    • Event Triggered Execution: Netsh Helper DLL
                                    PID:416
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    PID:2004
                                    • C:\Windows\server.exe
                                      "C:\Windows\server.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3544
                                      • C:\Windows\SysWOW64\netsh.exe
                                        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                        19⤵
                                        • Modifies Windows Firewall
                                        • Event Triggered Execution: Netsh Helper DLL
                                        PID:1816
                                      • C:\Windows\SysWOW64\netsh.exe
                                        netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                        19⤵
                                        • Event Triggered Execution: Netsh Helper DLL
                                        PID:3416
                                      • C:\Windows\SysWOW64\netsh.exe
                                        netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                        19⤵
                                        • Modifies Windows Firewall
                                        PID:2432
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:4000
                                        • C:\Windows\server.exe
                                          "C:\Windows\server.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Drops startup file
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Drops file in Program Files directory
                                          • Drops file in Windows directory
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2092
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                            21⤵
                                              PID:1812
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                              21⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              PID:956
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                              21⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              PID:4828
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                              21⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              PID:3596
                                              • C:\Windows\server.exe
                                                "C:\Windows\server.exe"
                                                22⤵
                                                • Checks computer location settings
                                                • Drops startup file
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Drops file in Program Files directory
                                                • Drops file in Windows directory
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4660
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                  23⤵
                                                  • Modifies Windows Firewall
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  PID:4848
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                  23⤵
                                                  • Modifies Windows Firewall
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  PID:208
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                  23⤵
                                                  • Modifies Windows Firewall
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  PID:1520
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                  23⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  PID:1600
                                                  • C:\Windows\server.exe
                                                    "C:\Windows\server.exe"
                                                    24⤵
                                                    • Checks computer location settings
                                                    • Drops startup file
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Drops file in Program Files directory
                                                    • Drops file in Windows directory
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2752
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                      25⤵
                                                      • Modifies Windows Firewall
                                                      • Event Triggered Execution: Netsh Helper DLL
                                                      PID:3820
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                      25⤵
                                                      • Modifies Windows Firewall
                                                      • Event Triggered Execution: Netsh Helper DLL
                                                      PID:3952
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                      25⤵
                                                      • Modifies Windows Firewall
                                                      • Event Triggered Execution: Netsh Helper DLL
                                                      PID:4000
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                      25⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Drops file in Windows directory
                                                      PID:1604
                                                      • C:\Windows\server.exe
                                                        "C:\Windows\server.exe"
                                                        26⤵
                                                        • Checks computer location settings
                                                        • Drops startup file
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Drops file in Program Files directory
                                                        • Drops file in Windows directory
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3252
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                          27⤵
                                                          • Modifies Windows Firewall
                                                          • Event Triggered Execution: Netsh Helper DLL
                                                          PID:1656
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                          27⤵
                                                          • Modifies Windows Firewall
                                                          PID:1516
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                          27⤵
                                                          • Modifies Windows Firewall
                                                          • Event Triggered Execution: Netsh Helper DLL
                                                          PID:3944
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                          27⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          PID:3464
                                                          • C:\Windows\server.exe
                                                            "C:\Windows\server.exe"
                                                            28⤵
                                                            • Checks computer location settings
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Drops file in Program Files directory
                                                            • Drops file in Windows directory
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1744
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                              29⤵
                                                              • Modifies Windows Firewall
                                                              PID:4548
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                              29⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:4364
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                              29⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:184
                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                              29⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              PID:3516
                                                              • C:\Windows\server.exe
                                                                "C:\Windows\server.exe"
                                                                30⤵
                                                                • Checks computer location settings
                                                                • Drops startup file
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                • Drops file in Program Files directory
                                                                • Drops file in Windows directory
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1460
                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                  netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                  31⤵
                                                                  • Modifies Windows Firewall
                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                  PID:4040
                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                  netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                                  31⤵
                                                                  • Modifies Windows Firewall
                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                  PID:3384
                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                  netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                  31⤵
                                                                  • Modifies Windows Firewall
                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                  PID:2752
                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                  31⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  PID:2840
                                                                  • C:\Windows\server.exe
                                                                    "C:\Windows\server.exe"
                                                                    32⤵
                                                                    • Checks computer location settings
                                                                    • Drops startup file
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Program Files directory
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1628
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                      33⤵
                                                                      • Modifies Windows Firewall
                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                      PID:5076
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                                      33⤵
                                                                      • Modifies Windows Firewall
                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                      PID:1380
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                      33⤵
                                                                      • Modifies Windows Firewall
                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                      PID:3972
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                      33⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      PID:4200
                                                                      • C:\Windows\server.exe
                                                                        "C:\Windows\server.exe"
                                                                        34⤵
                                                                        • Checks computer location settings
                                                                        • Drops startup file
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Program Files directory
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4048
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                          35⤵
                                                                          • Modifies Windows Firewall
                                                                          PID:3560
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                                          35⤵
                                                                          • Modifies Windows Firewall
                                                                          PID:2096
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                          35⤵
                                                                          • Modifies Windows Firewall
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          PID:4956
                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                          35⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Drops file in Windows directory
                                                                          PID:4068
                                                                          • C:\Windows\server.exe
                                                                            "C:\Windows\server.exe"
                                                                            36⤵
                                                                            • Checks computer location settings
                                                                            • Drops startup file
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            • Drops file in Program Files directory
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4632
                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                              netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                              37⤵
                                                                              • Modifies Windows Firewall
                                                                              PID:1492
                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                              netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                                              37⤵
                                                                              • Modifies Windows Firewall
                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                              PID:3280
                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                              netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                              37⤵
                                                                              • Modifies Windows Firewall
                                                                              PID:3156
                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                              37⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              PID:3508
                                                                              • C:\Windows\server.exe
                                                                                "C:\Windows\server.exe"
                                                                                38⤵
                                                                                • Checks computer location settings
                                                                                • Drops startup file
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                • Drops file in Program Files directory
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2120
                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                  netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                                  39⤵
                                                                                  • Modifies Windows Firewall
                                                                                  PID:1956
                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                  netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                                                  39⤵
                                                                                  • Modifies Windows Firewall
                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                  PID:2652
                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                  netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                                  39⤵
                                                                                  • Modifies Windows Firewall
                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                  PID:864
                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                  39⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Windows directory
                                                                                  PID:3456
                                                                                  • C:\Windows\server.exe
                                                                                    "C:\Windows\server.exe"
                                                                                    40⤵
                                                                                    • Checks computer location settings
                                                                                    • Drops startup file
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • Drops file in Program Files directory
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2476
                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                      netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                                      41⤵
                                                                                      • Modifies Windows Firewall
                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                      PID:4544
                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                      netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                                                      41⤵
                                                                                      • Modifies Windows Firewall
                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                      PID:3968
                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                      netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                                      41⤵
                                                                                      • Modifies Windows Firewall
                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                      PID:1964
                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                      41⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in Windows directory
                                                                                      PID:2304
                                                                                      • C:\Windows\server.exe
                                                                                        "C:\Windows\server.exe"
                                                                                        42⤵
                                                                                        • Checks computer location settings
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Drops file in Program Files directory
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1628
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                                          43⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:5100
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                                                          43⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:3868
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                                          43⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:3684
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                          43⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Windows directory
                                                                                          PID:1960
                                                                                          • C:\Windows\server.exe
                                                                                            "C:\Windows\server.exe"
                                                                                            44⤵
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Program Files directory
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2456
                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                              netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                                              45⤵
                                                                                              • Modifies Windows Firewall
                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                              PID:2104
                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                              netsh firewall delete allowedprogram "C:\Windows\server.exe"
                                                                                              45⤵
                                                                                              • Modifies Windows Firewall
                                                                                              PID:3456
                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                              netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
                                                                                              45⤵
                                                                                              • Modifies Windows Firewall
                                                                                              PID:3452
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                              45⤵
                                                                                                PID:2752

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            server.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log
            • Size 496B
            • SHA256 d165b248678c73e289a7d4a8aa74acc5c09408e58b8f2abd668013ca12c00cc4
            • MD5 SHA1 SHA512
            Submit Download

            svchost.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.log
            • Size 408B
            • SHA256 8f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
            • MD5 SHA1 SHA512
            Submit Download

            melt.txt
            • Path C:\Users\Admin\AppData\Local\Temp\melt.txt
            • Size 21B
            • SHA256 0944e1d01a6e4926eb610353fb63f4ec70c3cc91dd03a49f90a256b67da9c3d1
            • MD5 SHA1 SHA512
            Submit Download

            app
            • Path C:\Users\Admin\AppData\Roaming\app
            • Size 5B
            • SHA256 a7bff94c7cdef50b67a3bab142ebcec4d360491e339581c41f433fec6d002f48
            • MD5 SHA1 SHA512
            Submit Download

            server.exe
            • Path C:\Windows\server.exe
            • Size 93KB
            • SHA256 8887919fe07f6127f8842a8ef02d2c3c8e964046a6d5f41640e3811f520ec9db
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1716-14-0x0000000075220000-0x00000000757D1000-memory.dmp
            Download

            memory/1716-15-0x0000000075220000-0x00000000757D1000-memory.dmp
            Download

            memory/1716-65-0x0000000075220000-0x00000000757D1000-memory.dmp
            Download

            memory/2884-0-0x0000000075222000-0x0000000075223000-memory.dmp
            Download

            memory/2884-1-0x0000000075220000-0x00000000757D1000-memory.dmp
            Download

            memory/2884-2-0x0000000075220000-0x00000000757D1000-memory.dmp
            Download

            memory/2884-13-0x0000000075220000-0x00000000757D1000-memory.dmp
            Download