Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/09/2024, 18:38

240927-w984jstgjr 10

27/09/2024, 18:31

240927-w6aftatfjk 10

Analysis

  • max time kernel
    17s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/09/2024, 18:31

General

  • Target

    weave.exe

  • Size

    18.2MB

  • MD5

    f293ebde82be4a4c20f5b58a05384108

  • SHA1

    2240637695575a69e8918a9e9083d8f6d6a25356

  • SHA256

    6ee011dc3dc0568d97acddc89bfbae917c42a811a99cd851e17bae209e9e7506

  • SHA512

    a1a222e1203baad3141f2fbf3fca6f511842556c8175cdc6ea735e494aa9e923ef53d906c79bf53af1a1ec1e113cd70e5f06fb6068faf89912726e520e592224

  • SSDEEP

    393216:duxU/9YlNS1YOmAP0ybcsOCdha3hgw7KQs6Qg5H2Ym8IBX3Iv:dP/9YzC3csZa3hgRgJIBXE

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Power Settings 1 TTPs 5 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:636
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:428
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:684
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:988
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:556
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
              1⤵
                PID:536
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1028
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1044
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1152
                    • C:\Program Files\Microsoft\Edge\updater.exe
                      "C:\Program Files\Microsoft\Edge\updater.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:4700
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                      PID:1208
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1260
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1296
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                          1⤵
                            PID:1308
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                              PID:1408
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                2⤵
                                  PID:3048
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                1⤵
                                • Indicator Removal: Clear Windows Event Logs
                                PID:1428
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                1⤵
                                  PID:1500
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1516
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1648
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1708
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k NetworkService -p
                                        1⤵
                                          PID:1748
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1760
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                            1⤵
                                              PID:1808
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1816
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1828
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:1908
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1916
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:1368
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2184
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2384
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2552
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2560
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                1⤵
                                                                  PID:2580
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2604
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2628
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                      1⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2620
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2640
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2748
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:2844
                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                            1⤵
                                                                              PID:3120
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                                PID:3384
                                                                                • C:\Users\Admin\AppData\Local\Temp\weave.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\weave.exe"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3532
                                                                                  • C:\Users\Admin\AppData\Local\Temp\cli_gui.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\cli_gui.exe"
                                                                                    3⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Checks whether UAC is enabled
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3372
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      4⤵
                                                                                        PID:1636
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\windows\system32'" > NUL 2>&1
                                                                                        4⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1972
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -Command "Add-MpPreference -ExclusionPath 'C:\windows\system32'"
                                                                                          5⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2548
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c cls
                                                                                        4⤵
                                                                                          PID:3980
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c cls
                                                                                          4⤵
                                                                                            PID:3408
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c cls
                                                                                            4⤵
                                                                                              PID:4620
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\windows\system32'" > NUL 2>&1
                                                                                              4⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4804
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell -Command "Add-MpPreference -ExclusionPath 'C:\windows\system32'"
                                                                                                5⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4016
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c cls
                                                                                              4⤵
                                                                                                PID:388
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c cls
                                                                                                4⤵
                                                                                                  PID:1548
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c cls
                                                                                                  4⤵
                                                                                                    PID:2852
                                                                                                • C:\Windows\system32\updater.exe
                                                                                                  "C:\Windows\system32\updater.exe"
                                                                                                  3⤵
                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2316
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                2⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2344
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                                                                                2⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3008
                                                                                                • C:\Windows\System32\sc.exe
                                                                                                  sc stop UsoSvc
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:2592
                                                                                                • C:\Windows\System32\sc.exe
                                                                                                  sc stop WaaSMedicSvc
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:3404
                                                                                                • C:\Windows\System32\sc.exe
                                                                                                  sc stop wuauserv
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:3424
                                                                                                • C:\Windows\System32\sc.exe
                                                                                                  sc stop bits
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:4808
                                                                                                • C:\Windows\System32\sc.exe
                                                                                                  sc stop dosvc
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:1344
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                                                2⤵
                                                                                                • Power Settings
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1068
                                                                                                • C:\Windows\System32\powercfg.exe
                                                                                                  powercfg /x -hibernate-timeout-ac 0
                                                                                                  3⤵
                                                                                                  • Power Settings
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3376
                                                                                                • C:\Windows\System32\powercfg.exe
                                                                                                  powercfg /x -hibernate-timeout-dc 0
                                                                                                  3⤵
                                                                                                  • Power Settings
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1660
                                                                                                • C:\Windows\System32\powercfg.exe
                                                                                                  powercfg /x -standby-timeout-ac 0
                                                                                                  3⤵
                                                                                                  • Power Settings
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2496
                                                                                                • C:\Windows\System32\powercfg.exe
                                                                                                  powercfg /x -standby-timeout-dc 0
                                                                                                  3⤵
                                                                                                  • Power Settings
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1728
                                                                                              • C:\Windows\System32\dialer.exe
                                                                                                C:\Windows\System32\dialer.exe
                                                                                                2⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2352
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
                                                                                                2⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1164
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  3⤵
                                                                                                    PID:3956
                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                  C:\Windows\System32\schtasks.exe /run /tn "MicrosoftEdge"
                                                                                                  2⤵
                                                                                                    PID:2104
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      3⤵
                                                                                                        PID:1012
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                    1⤵
                                                                                                      PID:3508
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                      1⤵
                                                                                                        PID:3544
                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:3940
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                                          1⤵
                                                                                                            PID:4044
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:4052
                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                              1⤵
                                                                                                                PID:2940
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                                1⤵
                                                                                                                  PID:4352
                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                                  1⤵
                                                                                                                    PID:4364
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                    1⤵
                                                                                                                      PID:3396
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                                      1⤵
                                                                                                                        PID:3960
                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                        1⤵
                                                                                                                          PID:888
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                          1⤵
                                                                                                                            PID:4900
                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                            1⤵
                                                                                                                              PID:4092
                                                                                                                            • C:\Windows\system32\SppExtComObj.exe
                                                                                                                              C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:4152
                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                1⤵
                                                                                                                                  PID:2452
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:700
                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                    1⤵
                                                                                                                                      PID:4160
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                      1⤵
                                                                                                                                        PID:1508

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        627073ee3ca9676911bee35548eff2b8

                                                                                                                                        SHA1

                                                                                                                                        4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                        SHA256

                                                                                                                                        85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                        SHA512

                                                                                                                                        3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        944B

                                                                                                                                        MD5

                                                                                                                                        2e8eb51096d6f6781456fef7df731d97

                                                                                                                                        SHA1

                                                                                                                                        ec2aaf851a618fb43c3d040a13a71997c25bda43

                                                                                                                                        SHA256

                                                                                                                                        96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

                                                                                                                                        SHA512

                                                                                                                                        0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        944B

                                                                                                                                        MD5

                                                                                                                                        8cb7f4b4ab204cacd1af6b29c2a2042c

                                                                                                                                        SHA1

                                                                                                                                        244540c38e33eac05826d54282a0bfa60340d6a1

                                                                                                                                        SHA256

                                                                                                                                        4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

                                                                                                                                        SHA512

                                                                                                                                        7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        944B

                                                                                                                                        MD5

                                                                                                                                        80707036df540b6657f9d443b449e3c3

                                                                                                                                        SHA1

                                                                                                                                        b3e7d5d97274942164bf93c8c4b8a9b68713f46f

                                                                                                                                        SHA256

                                                                                                                                        6651e5f976619cef991deef61776cf43d4c4b3d7c551dd2192b647df71586ab0

                                                                                                                                        SHA512

                                                                                                                                        65e41e9e730fed4f7a7d3f6f35875a16948b897f87c8c70b371fd0ac7f0951814f6a75e7698665194bbc65a3665a684e7be229e7e24193b50483ae7e55eebf4f

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uqsppxpw.snd.ps1

                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cli_gui.exe

                                                                                                                                        Filesize

                                                                                                                                        2.9MB

                                                                                                                                        MD5

                                                                                                                                        8f21c4390128917bf5af5c2ee3fbc592

                                                                                                                                        SHA1

                                                                                                                                        733cc166b3161772755edf69314003a4a5e87953

                                                                                                                                        SHA256

                                                                                                                                        78b628830cd84013ba1bdab6c5f4a1529f828119157a77d212d86e82f35a817b

                                                                                                                                        SHA512

                                                                                                                                        c5116b27a4f722168c934319cd804a0390490be8341f27d39337877ce1c14e72c3dcdf725b982961c14de0a3da96362f2a9d4f4c486b7658c87c4801155cb015

                                                                                                                                      • C:\Windows\System32\updater.exe

                                                                                                                                        Filesize

                                                                                                                                        5.7MB

                                                                                                                                        MD5

                                                                                                                                        8cd62e3ece85c4c3e9f6f7c816256adf

                                                                                                                                        SHA1

                                                                                                                                        9712769be3f755c5ecbe68d38800a3a8ecdaf324

                                                                                                                                        SHA256

                                                                                                                                        39ebcdbb6993787be2ed9d2b6668b9ee2707ca483a66b51d1302bfc610ba021b

                                                                                                                                        SHA512

                                                                                                                                        a0aa9f0e6542c526fc18d48ab945d8be3245900381c9640f6e122a633a15dd9a9364bacd830fbc588a926ebef8240300c1fbf4211eae600cff8b7e2c63613501

                                                                                                                                      • memory/428-84-0x000001A65DA70000-0x000001A65DA97000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/428-85-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/536-99-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/536-98-0x000001954A1C0000-0x000001954A1E7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/556-96-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/556-95-0x0000029BFEF30000-0x0000029BFEF57000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/636-76-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/636-75-0x0000028190000000-0x0000028190027000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/636-74-0x000002818FDB0000-0x000002818FDD1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        132KB

                                                                                                                                      • memory/684-79-0x00000219E6960000-0x00000219E6987000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/684-80-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/988-87-0x00000222535D0000-0x00000222535F7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/988-88-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1028-101-0x000001A571D00000-0x000001A571D27000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1028-102-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1044-104-0x00000227B5860000-0x00000227B5887000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1044-105-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1152-108-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1152-107-0x000001B8A39A0000-0x000001B8A39C7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1208-112-0x000001E5F6730000-0x000001E5F6757000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1208-113-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1260-115-0x000002301DDA0000-0x000002301DDC7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1260-116-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1296-129-0x0000029829690000-0x00000298296B7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1428-126-0x00007FFEC51B0000-0x00007FFEC51C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1428-125-0x000001D3FD000000-0x000001D3FD027000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1648-128-0x00000278B2370000-0x00000278B2397000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/2316-60-0x00007FF679250000-0x00007FF679815000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.8MB

                                                                                                                                      • memory/2352-63-0x00007FFF05120000-0x00007FFF05329000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/2352-64-0x00007FFF043C0000-0x00007FFF0447D000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        756KB

                                                                                                                                      • memory/2548-27-0x000001DE59360000-0x000001DE59382000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/3372-20-0x00007FF6A0DB0000-0x00007FF6A15E9000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8.2MB

                                                                                                                                      • memory/3372-26-0x00007FFF051C7000-0x00007FFF051C9000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                      • memory/3372-49-0x00007FF6A0DB0000-0x00007FF6A15E9000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8.2MB

                                                                                                                                      • memory/3532-1-0x0000000000400000-0x0000000001892000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        20.6MB

                                                                                                                                      • memory/3532-2-0x0000000000400000-0x0000000001892000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        20.6MB

                                                                                                                                      • memory/3532-3-0x0000000000400000-0x0000000001892000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        20.6MB

                                                                                                                                      • memory/3532-25-0x0000000000400000-0x0000000001892000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        20.6MB

                                                                                                                                      • memory/3532-0-0x0000000000400000-0x0000000001892000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        20.6MB