Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 04:12

General

  • Target

    984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08.exe

  • Size

    93KB

  • MD5

    173883b31d172e5140f98fd0e927ff10

  • SHA1

    1e477ebc749e1ef65c820cfb959d96ffc058b587

  • SHA256

    984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08

  • SHA512

    01d262922177e746898cfdf9fee9d7b85a273ff43d445cf40f5ee989b51a08bfe71eb270b501a164192565666e4aaef701cbf6594e89c152d9acc43ca881c56a

  • SSDEEP

    1536:XFJGER1tMnnwlOU5oTRKwjEwzGi1dDsKngS:XFJMnnwlOUWT0hi1dzg

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Modifies Windows Firewall 2 TTPs 64 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 44 IoCs
  • Drops file in Program Files directory 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08.exe
    "C:\Users\Admin\AppData\Local\Temp\984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • System Location Discovery: System Language Discovery
        PID:3088
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
        3⤵
          PID:4644
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2728
        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:412
          • C:\Users\Admin\AppData\Local\Temp\server.exe
            "C:\Users\Admin\AppData\Local\Temp\server.exe"
            4⤵
            • Checks computer location settings
            • Drops startup file
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3396
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
              5⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:3756
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
              5⤵
              • Modifies Windows Firewall
              PID:4616
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
              5⤵
              • Modifies Windows Firewall
              • System Location Discovery: System Language Discovery
              PID:1148
            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4964
              • C:\Users\Admin\AppData\Local\Temp\server.exe
                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                6⤵
                • Checks computer location settings
                • Drops startup file
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1940
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                  7⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:2384
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                  7⤵
                  • Modifies Windows Firewall
                  PID:3388
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                  7⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:4380
                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2920
                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                    8⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1232
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                      9⤵
                        PID:3496
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:2420
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                        9⤵
                        • Modifies Windows Firewall
                        PID:5112
                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3100
                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                          10⤵
                          • Checks computer location settings
                          • Drops startup file
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3700
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                            11⤵
                            • Modifies Windows Firewall
                            PID:3396
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                            11⤵
                            • System Location Discovery: System Language Discovery
                            PID:1676
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                            11⤵
                            • Modifies Windows Firewall
                            • System Location Discovery: System Language Discovery
                            PID:2348
                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                            11⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            PID:1872
                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                              12⤵
                              • Checks computer location settings
                              • Drops startup file
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Program Files directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4656
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                13⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                PID:3784
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                13⤵
                                • System Location Discovery: System Language Discovery
                                PID:2920
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                13⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                • System Location Discovery: System Language Discovery
                                PID:2460
                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                13⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                PID:2424
                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                  14⤵
                                  • Checks computer location settings
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Drops file in Program Files directory
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3264
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                    15⤵
                                    • Modifies Windows Firewall
                                    PID:3692
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                    15⤵
                                    • Modifies Windows Firewall
                                    PID:444
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                    15⤵
                                    • Modifies Windows Firewall
                                    • Event Triggered Execution: Netsh Helper DLL
                                    PID:64
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                    15⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    PID:4056
                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                      16⤵
                                      • Checks computer location settings
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Drops file in Program Files directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3156
                                      • C:\Windows\SysWOW64\netsh.exe
                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                        17⤵
                                        • Modifies Windows Firewall
                                        PID:4496
                                      • C:\Windows\SysWOW64\netsh.exe
                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                        17⤵
                                        • Modifies Windows Firewall
                                        PID:1080
                                      • C:\Windows\SysWOW64\netsh.exe
                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                        17⤵
                                        • Event Triggered Execution: Netsh Helper DLL
                                        PID:4032
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                        17⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:2104
                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                          18⤵
                                          • Checks computer location settings
                                          • Drops startup file
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Drops file in Program Files directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1120
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                            19⤵
                                            • Modifies Windows Firewall
                                            • Event Triggered Execution: Netsh Helper DLL
                                            PID:2392
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                            19⤵
                                              PID:3532
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                              19⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:3584
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                              19⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              PID:2424
                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                20⤵
                                                • Checks computer location settings
                                                • Drops startup file
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Drops file in Program Files directory
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1104
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                  21⤵
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  PID:3692
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                  21⤵
                                                  • Modifies Windows Firewall
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  PID:444
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                  21⤵
                                                    PID:3340
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                    21⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    PID:4532
                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                      22⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Drops file in Program Files directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2872
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                        23⤵
                                                        • Event Triggered Execution: Netsh Helper DLL
                                                        PID:1340
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                        23⤵
                                                        • Event Triggered Execution: Netsh Helper DLL
                                                        • System Location Discovery: System Language Discovery
                                                        PID:628
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                        23⤵
                                                        • Modifies Windows Firewall
                                                        PID:5012
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                        23⤵
                                                        • Executes dropped EXE
                                                        PID:1688
                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                          24⤵
                                                          • Drops startup file
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3356
                                                          • C:\Windows\SysWOW64\netsh.exe
                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                            25⤵
                                                              PID:5060
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                              25⤵
                                                              • Modifies Windows Firewall
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4880
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                              25⤵
                                                                PID:4888
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                25⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                PID:4832
                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                  26⤵
                                                                  • Drops startup file
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Program Files directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:64
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                    27⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1620
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                    27⤵
                                                                      PID:2152
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                      27⤵
                                                                        PID:3976
                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                        27⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2736
                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                          28⤵
                                                                          • Drops startup file
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2088
                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                            29⤵
                                                                            • Modifies Windows Firewall
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2148
                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                            29⤵
                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                            PID:3748
                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                            29⤵
                                                                            • Modifies Windows Firewall
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3392
                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                            29⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2996
                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                              30⤵
                                                                              • Drops startup file
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3688
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                31⤵
                                                                                • Modifies Windows Firewall
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4140
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                31⤵
                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                PID:1532
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                31⤵
                                                                                • Modifies Windows Firewall
                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                PID:824
                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                31⤵
                                                                                • Executes dropped EXE
                                                                                PID:2912
                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                  32⤵
                                                                                  • Checks computer location settings
                                                                                  • Drops startup file
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • Drops file in Program Files directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5116
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                    33⤵
                                                                                    • Modifies Windows Firewall
                                                                                    PID:4812
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                    33⤵
                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                    PID:5080
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                    33⤵
                                                                                      PID:5008
                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                      33⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3340
                                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                        34⤵
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Drops file in Program Files directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1416
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                          35⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:2348
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                          35⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:2232
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                          35⤵
                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                          PID:3540
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                          35⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          PID:2384
                                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                            36⤵
                                                                                            • Checks computer location settings
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Program Files directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1760
                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                              37⤵
                                                                                                PID:3116
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                37⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:1668
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                37⤵
                                                                                                • Modifies Windows Firewall
                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                PID:3412
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                37⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                PID:4236
                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                  38⤵
                                                                                                  • Drops startup file
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4004
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                    39⤵
                                                                                                    • Modifies Windows Firewall
                                                                                                    PID:2528
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                    39⤵
                                                                                                    • Modifies Windows Firewall
                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4696
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                    39⤵
                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                    PID:1136
                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                    39⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1556
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                      40⤵
                                                                                                      • Drops startup file
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • Drops file in Program Files directory
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2276
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                        41⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4368
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                        41⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2184
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                        41⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        PID:2872
                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                        41⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3748
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                          42⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Drops startup file
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in System32 directory
                                                                                                          • Drops file in Program Files directory
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4956
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                            43⤵
                                                                                                            • Modifies Windows Firewall
                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                            PID:412
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                            43⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4736
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                            43⤵
                                                                                                            • Modifies Windows Firewall
                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5092
                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                            43⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:3292
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                              44⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Drops startup file
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in System32 directory
                                                                                                              • Drops file in Program Files directory
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:1760
                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                45⤵
                                                                                                                  PID:2912
                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                  45⤵
                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                  PID:2188
                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                  45⤵
                                                                                                                    PID:2880
                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                    45⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5080
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                      46⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops startup file
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:1380
                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                        47⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3420
                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                        47⤵
                                                                                                                        • Modifies Windows Firewall
                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                        PID:5028
                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                        47⤵
                                                                                                                          PID:3996
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                          47⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:628
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                            48⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Drops startup file
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:392
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                              49⤵
                                                                                                                              • Modifies Windows Firewall
                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4748
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                              49⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4380
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                              49⤵
                                                                                                                              • Modifies Windows Firewall
                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                              PID:4668
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                              49⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2612
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                50⤵
                                                                                                                                • Drops startup file
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2632
                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                  51⤵
                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                  PID:5092
                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                  51⤵
                                                                                                                                    PID:2628
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                    51⤵
                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:644
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                    51⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2152
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                      52⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Drops startup file
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4100
                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                        53⤵
                                                                                                                                          PID:3080
                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                          53⤵
                                                                                                                                            PID:5116
                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                            53⤵
                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                            PID:64
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                            53⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2104
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                              54⤵
                                                                                                                                              • Drops startup file
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:4648
                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                55⤵
                                                                                                                                                  PID:3996
                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                  55⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4656
                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                  55⤵
                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                  PID:4636
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                  55⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2208
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                    56⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    • Drops startup file
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:3704
                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                      57⤵
                                                                                                                                                        PID:400
                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                        57⤵
                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3116
                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                        57⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:1404
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                        57⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:4384
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                          58⤵
                                                                                                                                                          • Drops startup file
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:2400
                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                            59⤵
                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                            PID:1816
                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                            59⤵
                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                            PID:3404
                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                            59⤵
                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                            PID:1732
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                            59⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3472
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                              60⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Drops startup file
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:2904
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                61⤵
                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                PID:4708
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                61⤵
                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                PID:5044
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                61⤵
                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                PID:2668
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                61⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3340
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                  62⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Drops startup file
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:4624
                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                    63⤵
                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                    PID:4512
                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                    63⤵
                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                    PID:3288
                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                    63⤵
                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                    PID:1180
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                    63⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3392
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                      64⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Drops startup file
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:1956
                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                        65⤵
                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:3784
                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                        65⤵
                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                        PID:4736
                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                        65⤵
                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                        PID:3688
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                        65⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5016
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                          66⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Drops startup file
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:4040
                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                            67⤵
                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                            PID:4840
                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                            67⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:3404
                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                            67⤵
                                                                                                                                                                              PID:3264
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                              67⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              PID:4532
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                68⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:2652
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                  69⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  PID:1376
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                  69⤵
                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                  PID:1688
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                  69⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  PID:2776
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                  69⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  PID:4452
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                    70⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:4256
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                      71⤵
                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                      PID:1964
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                      71⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      PID:2436
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                      71⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                      PID:2648
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                      71⤵
                                                                                                                                                                                        PID:4400
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                          72⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:3292
                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                            73⤵
                                                                                                                                                                                              PID:4144
                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                              netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                              73⤵
                                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                              PID:1748
                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                              73⤵
                                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:3180
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                              73⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              PID:5116
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                74⤵
                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                    PID:3264
                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                    PID:3216
                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                      PID:2344
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      PID:232
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:768
                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:2520
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                              PID:1152
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:3704
                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3612
                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  PID:444
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:364
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:696
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        PID:4188
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:3540
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2012
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                            PID:1080
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2892
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                              PID:1688
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:1180
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3896
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                  PID:3584
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                    PID:2996
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    PID:2628
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:4440
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:2524
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                                        PID:3864

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log

                                                            Filesize

                                                            496B

                                                            MD5

                                                            a4467dea22bfd7e0083d680c571f5e7c

                                                            SHA1

                                                            59682ca656f04dd57f7ef4552b96f71d73196ea2

                                                            SHA256

                                                            d165b248678c73e289a7d4a8aa74acc5c09408e58b8f2abd668013ca12c00cc4

                                                            SHA512

                                                            73d25a179994c16b2b3a357e8b068ebf415418033cd601d7084b3a44d822cb99c33c396c9a27ad6fa2066748032e21f09ce89461bc3180ec071d2d64e68ad790

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.log

                                                            Filesize

                                                            408B

                                                            MD5

                                                            661cab77d3b907e8057f2e689e995af3

                                                            SHA1

                                                            5d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c

                                                            SHA256

                                                            8f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2

                                                            SHA512

                                                            2523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67

                                                          • C:\Users\Admin\AppData\Local\Temp\melt.txt

                                                            Filesize

                                                            44B

                                                            MD5

                                                            298802dff6aa26d4fb941c7ccf5c0849

                                                            SHA1

                                                            11e518ca3409f1863ebc2d3f1be9fb701bad52c0

                                                            SHA256

                                                            df99fdbdf7b92b29b1bf1ca4283b4de2e04643b9739d2d1089ab5808e8e5665d

                                                            SHA512

                                                            0301017dfef1b74855d6535f3fd542257689479cb933c2e8742b5b6b94e26107fa38e7fc21bdb83d45184750eced344856092330fb30a1ebbc24b2b9004c8946

                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe

                                                            Filesize

                                                            93KB

                                                            MD5

                                                            173883b31d172e5140f98fd0e927ff10

                                                            SHA1

                                                            1e477ebc749e1ef65c820cfb959d96ffc058b587

                                                            SHA256

                                                            984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08

                                                            SHA512

                                                            01d262922177e746898cfdf9fee9d7b85a273ff43d445cf40f5ee989b51a08bfe71eb270b501a164192565666e4aaef701cbf6594e89c152d9acc43ca881c56a

                                                          • C:\Users\Admin\AppData\Roaming\app

                                                            Filesize

                                                            5B

                                                            MD5

                                                            69cf10399d0d1350c3698099796624cb

                                                            SHA1

                                                            d0b58b76ff065f51172971853a7da414286d9ea7

                                                            SHA256

                                                            a7bff94c7cdef50b67a3bab142ebcec4d360491e339581c41f433fec6d002f48

                                                            SHA512

                                                            5e1c9745b2b529c026e51fbff7fd4e1e0bd208c705b7da830459758d28c01b32b9bc93caa7ad60228d3e785784023d8a739fda0dab62d3c76770ea84c257f1f7

                                                          • memory/2032-14-0x00000000749B0000-0x0000000074F61000-memory.dmp

                                                            Filesize

                                                            5.7MB

                                                          • memory/2032-15-0x00000000749B0000-0x0000000074F61000-memory.dmp

                                                            Filesize

                                                            5.7MB

                                                          • memory/2032-50-0x00000000749B0000-0x0000000074F61000-memory.dmp

                                                            Filesize

                                                            5.7MB

                                                          • memory/4720-0-0x00000000749B2000-0x00000000749B3000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/4720-1-0x00000000749B0000-0x0000000074F61000-memory.dmp

                                                            Filesize

                                                            5.7MB

                                                          • memory/4720-2-0x00000000749B0000-0x0000000074F61000-memory.dmp

                                                            Filesize

                                                            5.7MB

                                                          • memory/4720-13-0x00000000749B0000-0x0000000074F61000-memory.dmp

                                                            Filesize

                                                            5.7MB