Analysis

  • max time kernel
    120s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 21:47

General

  • Target

    a872bfa41308674ce755d580307481089287f32c0da127b3e0334044361273dd.exe

  • Size

    93KB

  • MD5

    a113e36d190813b3f6cc19ea636f3e4e

  • SHA1

    93654319bd00ffee5969bcadfdab3322212fc536

  • SHA256

    a872bfa41308674ce755d580307481089287f32c0da127b3e0334044361273dd

  • SHA512

    0a97ea0ac853cb53fae9012d25fcf2f894ec9f1e0b18dc3a6a3a58325fdae1b03250b48998366e6dc0d1aa200f981c9d2587a8e913ca29f35fb5668e3b6069ce

  • SSDEEP

    1536:XFJGER1tMnnwlOU5oTRKwjEwzGi1dDsKngSb:XFJMnnwlOUWT0hi1dzgO

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Modifies Windows Firewall 2 TTPs 64 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 37 IoCs
  • Drops file in Program Files directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a872bfa41308674ce755d580307481089287f32c0da127b3e0334044361273dd.exe
    "C:\Users\Admin\AppData\Local\Temp\a872bfa41308674ce755d580307481089287f32c0da127b3e0334044361273dd.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2824
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:1708
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:4736
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2164
        • C:\Users\Admin\AppData\Local\Temp\server.exe
          "C:\Users\Admin\AppData\Local\Temp\server.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4220
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
            5⤵
              PID:3524
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
              5⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:1908
            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1180
              • C:\Users\Admin\AppData\Local\Temp\server.exe
                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3596
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                  7⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:872
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                  7⤵
                  • Modifies Windows Firewall
                  PID:3000
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                  7⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:3364
                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4188
                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                    8⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:712
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                      9⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:5104
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                      9⤵
                      • Modifies Windows Firewall
                      PID:3340
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                      9⤵
                        PID:1632
                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3008
                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                          10⤵
                          • Checks computer location settings
                          • Drops startup file
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4540
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                            11⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:4884
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                            11⤵
                            • Modifies Windows Firewall
                            PID:368
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                            11⤵
                            • Modifies Windows Firewall
                            • System Location Discovery: System Language Discovery
                            PID:2388
                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                            11⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4452
                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                              12⤵
                              • Checks computer location settings
                              • Drops startup file
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Program Files directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2628
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                13⤵
                                • Modifies Windows Firewall
                                PID:1716
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                13⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                • System Location Discovery: System Language Discovery
                                PID:2924
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                13⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                • System Location Discovery: System Language Discovery
                                PID:4776
                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                13⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                PID:4416
                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                  14⤵
                                  • Checks computer location settings
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Drops file in Program Files directory
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3124
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                    15⤵
                                      PID:5104
                                    • C:\Windows\SysWOW64\netsh.exe
                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                      15⤵
                                      • Modifies Windows Firewall
                                      • Event Triggered Execution: Netsh Helper DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:4220
                                    • C:\Windows\SysWOW64\netsh.exe
                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                      15⤵
                                      • Modifies Windows Firewall
                                      PID:1188
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                      15⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      PID:3976
                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                        16⤵
                                        • Checks computer location settings
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Drops file in Program Files directory
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4444
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                          17⤵
                                          • Event Triggered Execution: Netsh Helper DLL
                                          PID:3384
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                          17⤵
                                          • Modifies Windows Firewall
                                          • System Location Discovery: System Language Discovery
                                          PID:3380
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                          17⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4848
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                          17⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:2936
                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                            18⤵
                                            • Checks computer location settings
                                            • Drops startup file
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Drops file in Program Files directory
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3960
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                              19⤵
                                              • Event Triggered Execution: Netsh Helper DLL
                                              PID:4624
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                              19⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:1716
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                              19⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2760
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                              19⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              PID:3144
                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                20⤵
                                                • Checks computer location settings
                                                • Drops startup file
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Drops file in Program Files directory
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1424
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                  21⤵
                                                  • Modifies Windows Firewall
                                                  PID:920
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                  21⤵
                                                  • Modifies Windows Firewall
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:452
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                  21⤵
                                                  • Modifies Windows Firewall
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1188
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                  21⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  PID:2420
                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                    22⤵
                                                    • Checks computer location settings
                                                    • Drops startup file
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4816
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                      23⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2648
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                      23⤵
                                                      • Modifies Windows Firewall
                                                      PID:3076
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                      23⤵
                                                      • Modifies Windows Firewall
                                                      • System Location Discovery: System Language Discovery
                                                      PID:448
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                      23⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      PID:4420
                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                        24⤵
                                                        • Checks computer location settings
                                                        • Drops startup file
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Drops file in Program Files directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:684
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                          25⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1720
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                          25⤵
                                                          • Modifies Windows Firewall
                                                          PID:2184
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                          25⤵
                                                          • Event Triggered Execution: Netsh Helper DLL
                                                          PID:1552
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                          25⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4232
                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                            26⤵
                                                            • Checks computer location settings
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1620
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                              27⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:3008
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                              27⤵
                                                              • Modifies Windows Firewall
                                                              PID:3992
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                              27⤵
                                                                PID:3200
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                27⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:368
                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                  28⤵
                                                                  • Checks computer location settings
                                                                  • Drops startup file
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Program Files directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3376
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                    29⤵
                                                                      PID:4848
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                      29⤵
                                                                      • Modifies Windows Firewall
                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                      PID:888
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                      29⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3292
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                      29⤵
                                                                      • Executes dropped EXE
                                                                      PID:688
                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                        30⤵
                                                                        • Checks computer location settings
                                                                        • Drops startup file
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:868
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                          31⤵
                                                                          • Modifies Windows Firewall
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          PID:2220
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                          31⤵
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          PID:3964
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                          31⤵
                                                                            PID:4048
                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                            31⤵
                                                                            • Executes dropped EXE
                                                                            PID:828
                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                              32⤵
                                                                              • Checks computer location settings
                                                                              • Drops startup file
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4232
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                33⤵
                                                                                • Modifies Windows Firewall
                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3600
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                33⤵
                                                                                • Modifies Windows Firewall
                                                                                PID:724
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                33⤵
                                                                                  PID:1344
                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                  33⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  PID:1408
                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                    34⤵
                                                                                    • Checks computer location settings
                                                                                    • Drops startup file
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • Drops file in Program Files directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:368
                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                      35⤵
                                                                                        PID:4328
                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                        35⤵
                                                                                        • Modifies Windows Firewall
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3076
                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                        35⤵
                                                                                        • Modifies Windows Firewall
                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                        PID:2388
                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                        35⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        PID:3132
                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                          36⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • Drops file in Program Files directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2744
                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                            37⤵
                                                                                            • Modifies Windows Firewall
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1888
                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                            37⤵
                                                                                            • Modifies Windows Firewall
                                                                                            PID:1884
                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                            37⤵
                                                                                            • Modifies Windows Firewall
                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                            PID:2628
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                            37⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4196
                                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                              38⤵
                                                                                              • Checks computer location settings
                                                                                              • Drops startup file
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in System32 directory
                                                                                              • Drops file in Program Files directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2660
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                39⤵
                                                                                                • Modifies Windows Firewall
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1188
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                39⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:4908
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                39⤵
                                                                                                  PID:4732
                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                  39⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2620
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                    40⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Drops startup file
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    • Drops file in Program Files directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1408
                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                      41⤵
                                                                                                        PID:4524
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                        41⤵
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        PID:3156
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                        41⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        PID:3968
                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                        41⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3252
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                          42⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Drops startup file
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in System32 directory
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2980
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                            43⤵
                                                                                                            • Modifies Windows Firewall
                                                                                                            PID:3824
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                            43⤵
                                                                                                              PID:3588
                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                              43⤵
                                                                                                                PID:3360
                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                43⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                PID:3648
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                  44⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Drops startup file
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:828
                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                    45⤵
                                                                                                                    • Modifies Windows Firewall
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4600
                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                    45⤵
                                                                                                                    • Modifies Windows Firewall
                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                    PID:3628
                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                    45⤵
                                                                                                                    • Modifies Windows Firewall
                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4960
                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                    45⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:3244
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                      46⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops startup file
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:1848
                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                        47⤵
                                                                                                                        • Modifies Windows Firewall
                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                        PID:3340
                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                        47⤵
                                                                                                                        • Modifies Windows Firewall
                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                        PID:4192
                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                        47⤵
                                                                                                                        • Modifies Windows Firewall
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2624
                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                        47⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4796
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                          48⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Drops startup file
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4596
                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                            49⤵
                                                                                                                              PID:2416
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                              49⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5068
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                              49⤵
                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1452
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                              49⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:732
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                50⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Drops startup file
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4276
                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                  51⤵
                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                  PID:2124
                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                  51⤵
                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                  PID:4016
                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                  51⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4428
                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                  51⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:3732
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                    52⤵
                                                                                                                                    • Drops startup file
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4644
                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                      53⤵
                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                      PID:3948
                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                      53⤵
                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                      PID:4316
                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                      53⤵
                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                      PID:3456
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                      53⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3780
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                        54⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Drops startup file
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4544
                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                          55⤵
                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                          PID:1696
                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                          55⤵
                                                                                                                                            PID:2916
                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                            55⤵
                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                            PID:4188
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                            55⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2184
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                              56⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Drops startup file
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:2980
                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                57⤵
                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                PID:2008
                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                57⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:920
                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                57⤵
                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3088
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                57⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:3964
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                  58⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Drops startup file
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:1976
                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                    59⤵
                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                    PID:4428
                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                    59⤵
                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                    PID:3244
                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                    59⤵
                                                                                                                                                      PID:3024
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                      59⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3248
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                        60⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Drops startup file
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:3456
                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                          61⤵
                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                          PID:4316
                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                          61⤵
                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                          PID:5072
                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                          61⤵
                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                          PID:2352
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                          61⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:1632
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                            62⤵
                                                                                                                                                            • Drops startup file
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2252
                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                              63⤵
                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                              PID:4136
                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                              63⤵
                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                              PID:4596
                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                              63⤵
                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                              PID:4860
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                              63⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2032
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                64⤵
                                                                                                                                                                • Drops startup file
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:684
                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                  65⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4864
                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                  65⤵
                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                  PID:1204
                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                  65⤵
                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1532
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                  65⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:3900
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                    66⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • Drops startup file
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:3500
                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                      67⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4428
                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                      67⤵
                                                                                                                                                                        PID:4920
                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                        67⤵
                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:3948
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                        67⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2344
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                          68⤵
                                                                                                                                                                          • Drops startup file
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:3076
                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                            69⤵
                                                                                                                                                                              PID:4848
                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                              69⤵
                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3824
                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                              69⤵
                                                                                                                                                                                PID:2688
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                69⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:4460
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                  70⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:4416
                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                    71⤵
                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                    PID:4724
                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                    71⤵
                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                    PID:4392
                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                    71⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2852
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                    71⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    PID:1920
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                      72⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:920
                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                        73⤵
                                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                        PID:2420
                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                        73⤵
                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3380
                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                        73⤵
                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                        PID:2128
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                        73⤵
                                                                                                                                                                                          PID:3376

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log

                                          Filesize

                                          496B

                                          MD5

                                          a4467dea22bfd7e0083d680c571f5e7c

                                          SHA1

                                          59682ca656f04dd57f7ef4552b96f71d73196ea2

                                          SHA256

                                          d165b248678c73e289a7d4a8aa74acc5c09408e58b8f2abd668013ca12c00cc4

                                          SHA512

                                          73d25a179994c16b2b3a357e8b068ebf415418033cd601d7084b3a44d822cb99c33c396c9a27ad6fa2066748032e21f09ce89461bc3180ec071d2d64e68ad790

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.log

                                          Filesize

                                          408B

                                          MD5

                                          661cab77d3b907e8057f2e689e995af3

                                          SHA1

                                          5d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c

                                          SHA256

                                          8f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2

                                          SHA512

                                          2523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67

                                        • C:\Users\Admin\AppData\Local\Temp\melt.txt

                                          Filesize

                                          44B

                                          MD5

                                          298802dff6aa26d4fb941c7ccf5c0849

                                          SHA1

                                          11e518ca3409f1863ebc2d3f1be9fb701bad52c0

                                          SHA256

                                          df99fdbdf7b92b29b1bf1ca4283b4de2e04643b9739d2d1089ab5808e8e5665d

                                          SHA512

                                          0301017dfef1b74855d6535f3fd542257689479cb933c2e8742b5b6b94e26107fa38e7fc21bdb83d45184750eced344856092330fb30a1ebbc24b2b9004c8946

                                        • C:\Users\Admin\AppData\Local\Temp\server.exe

                                          Filesize

                                          93KB

                                          MD5

                                          a113e36d190813b3f6cc19ea636f3e4e

                                          SHA1

                                          93654319bd00ffee5969bcadfdab3322212fc536

                                          SHA256

                                          a872bfa41308674ce755d580307481089287f32c0da127b3e0334044361273dd

                                          SHA512

                                          0a97ea0ac853cb53fae9012d25fcf2f894ec9f1e0b18dc3a6a3a58325fdae1b03250b48998366e6dc0d1aa200f981c9d2587a8e913ca29f35fb5668e3b6069ce

                                        • C:\Users\Admin\AppData\Roaming\app

                                          Filesize

                                          5B

                                          MD5

                                          69cf10399d0d1350c3698099796624cb

                                          SHA1

                                          d0b58b76ff065f51172971853a7da414286d9ea7

                                          SHA256

                                          a7bff94c7cdef50b67a3bab142ebcec4d360491e339581c41f433fec6d002f48

                                          SHA512

                                          5e1c9745b2b529c026e51fbff7fd4e1e0bd208c705b7da830459758d28c01b32b9bc93caa7ad60228d3e785784023d8a739fda0dab62d3c76770ea84c257f1f7

                                        • memory/2328-0-0x00000000753D2000-0x00000000753D3000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2328-1-0x00000000753D0000-0x0000000075981000-memory.dmp

                                          Filesize

                                          5.7MB

                                        • memory/2328-2-0x00000000753D0000-0x0000000075981000-memory.dmp

                                          Filesize

                                          5.7MB

                                        • memory/2328-13-0x00000000753D0000-0x0000000075981000-memory.dmp

                                          Filesize

                                          5.7MB

                                        • memory/2872-14-0x00000000753D0000-0x0000000075981000-memory.dmp

                                          Filesize

                                          5.7MB

                                        • memory/2872-15-0x00000000753D0000-0x0000000075981000-memory.dmp

                                          Filesize

                                          5.7MB

                                        • memory/2872-50-0x00000000753D0000-0x0000000075981000-memory.dmp

                                          Filesize

                                          5.7MB