Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
38200755cbe...33.exe
windows10-2004-x64
829c7e87350...5b.exe
windows10-2004-x64
349cccd30a5...90.exe
windows10-2004-x64
3b17911ddea...82.exe
windows10-2004-x64
302ca4397da...51.exe
windows10-2004-x64
3022aeb126d...74.exe
windows10-2004-x64
9smb-7teux2sm.exe
windows10-2004-x64
9smb-onil0o36.exe
windows10-2004-x64
9malware-sa...ab.exe
windows10-2004-x64
10malware-sa...1).exe
windows10-2004-x64
malware-sa...n.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
300s -
max time network
286s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2025, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
smb-7teux2sm.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
smb-onil0o36.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win10v2004-20241007-en
General
-
Target
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
-
Size
1.4MB
-
MD5
f2e1d236c5d2c009e1749fc6479a9ede
-
SHA1
262c22ffd66c33da641558f3da23f7584881a782
-
SHA256
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233
-
SHA512
3b3174ac17e377028accf1ebfd6bd6ae97fc99c4e7814f8ad0fe707dc77d757f26d667333efb495a9b9768d49672737233c88d7a50b4dc81ad170f068ad95cc1
-
SSDEEP
24576:6EpKGrwKydag/jU7IZK8LNmf2+r+eauoUWg6ye2tX9t5WR4MJh:6nGrwKtg7U7I88Zi2/xxyeAt06a
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 4 IoCs
pid Process 3596 netsh.exe 516 netsh.exe 2464 netsh.exe 3320 netsh.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 icanhazip.com -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\id.txt wuauser.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3332 sc.exe 3604 sc.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Kills process with taskkill 7 IoCs
pid Process 980 taskkill.exe 440 taskkill.exe 4016 taskkill.exe 4376 taskkill.exe 3512 taskkill.exe 4060 taskkill.exe 432 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe 2660 wuauser.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4060 taskkill.exe Token: SeDebugPrivilege 432 taskkill.exe Token: SeDebugPrivilege 980 taskkill.exe Token: SeDebugPrivilege 440 taskkill.exe Token: SeDebugPrivilege 4016 taskkill.exe Token: SeDebugPrivilege 4376 taskkill.exe Token: SeDebugPrivilege 3512 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 760 wrote to memory of 4208 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 83 PID 760 wrote to memory of 4208 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 83 PID 760 wrote to memory of 4208 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 83 PID 4208 wrote to memory of 4060 4208 cmd.exe 85 PID 4208 wrote to memory of 4060 4208 cmd.exe 85 PID 4208 wrote to memory of 4060 4208 cmd.exe 85 PID 760 wrote to memory of 1328 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 87 PID 760 wrote to memory of 1328 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 87 PID 760 wrote to memory of 1328 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 87 PID 1328 wrote to memory of 432 1328 cmd.exe 89 PID 1328 wrote to memory of 432 1328 cmd.exe 89 PID 1328 wrote to memory of 432 1328 cmd.exe 89 PID 760 wrote to memory of 4300 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 102 PID 760 wrote to memory of 4300 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 102 PID 760 wrote to memory of 4300 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 102 PID 4300 wrote to memory of 3332 4300 cmd.exe 104 PID 4300 wrote to memory of 3332 4300 cmd.exe 104 PID 4300 wrote to memory of 3332 4300 cmd.exe 104 PID 760 wrote to memory of 3012 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 105 PID 760 wrote to memory of 3012 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 105 PID 760 wrote to memory of 3012 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 105 PID 3012 wrote to memory of 3604 3012 cmd.exe 107 PID 3012 wrote to memory of 3604 3012 cmd.exe 107 PID 3012 wrote to memory of 3604 3012 cmd.exe 107 PID 760 wrote to memory of 3624 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 108 PID 760 wrote to memory of 3624 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 108 PID 760 wrote to memory of 3624 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 108 PID 3624 wrote to memory of 3976 3624 cmd.exe 110 PID 3624 wrote to memory of 3976 3624 cmd.exe 110 PID 3624 wrote to memory of 3976 3624 cmd.exe 110 PID 760 wrote to memory of 3448 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 111 PID 760 wrote to memory of 3448 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 111 PID 760 wrote to memory of 3448 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 111 PID 3448 wrote to memory of 2108 3448 cmd.exe 113 PID 3448 wrote to memory of 2108 3448 cmd.exe 113 PID 3448 wrote to memory of 2108 3448 cmd.exe 113 PID 760 wrote to memory of 1872 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 114 PID 760 wrote to memory of 1872 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 114 PID 760 wrote to memory of 1872 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 114 PID 1872 wrote to memory of 3592 1872 cmd.exe 116 PID 1872 wrote to memory of 3592 1872 cmd.exe 116 PID 1872 wrote to memory of 3592 1872 cmd.exe 116 PID 760 wrote to memory of 4492 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 117 PID 760 wrote to memory of 4492 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 117 PID 760 wrote to memory of 4492 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 117 PID 4492 wrote to memory of 3692 4492 cmd.exe 119 PID 4492 wrote to memory of 3692 4492 cmd.exe 119 PID 4492 wrote to memory of 3692 4492 cmd.exe 119 PID 760 wrote to memory of 1760 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 120 PID 760 wrote to memory of 1760 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 120 PID 760 wrote to memory of 1760 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 120 PID 1760 wrote to memory of 1084 1760 cmd.exe 122 PID 1760 wrote to memory of 1084 1760 cmd.exe 122 PID 1760 wrote to memory of 1084 1760 cmd.exe 122 PID 760 wrote to memory of 4596 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 123 PID 760 wrote to memory of 4596 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 123 PID 760 wrote to memory of 4596 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 123 PID 4596 wrote to memory of 2696 4596 cmd.exe 125 PID 4596 wrote to memory of 2696 4596 cmd.exe 125 PID 4596 wrote to memory of 2696 4596 cmd.exe 125 PID 760 wrote to memory of 532 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 127 PID 760 wrote to memory of 532 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 127 PID 760 wrote to memory of 532 760 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe 127 PID 2660 wrote to memory of 2932 2660 wuauser.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe"C:\Users\Admin\AppData\Local\Temp\8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im mmc.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mmc.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop WELM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\sc.exesc stop WELM3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete WELM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\sc.exesc delete WELM3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add policy name=netbc2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=netbc3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3976
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filterlist name=block2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filterlist name=block3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filteraction name=block action=block2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=block action=block3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add filter filterlist=block any srcmask=32 srcport=0 dstaddr=me dstport=445 protocol=tcp description=4452⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=block any srcmask=32 srcport=0 dstaddr=me dstport=445 protocol=tcp description=4453⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static add rule name=block policy=netbc filterlist=block filteraction=block2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=block policy=netbc filterlist=block filteraction=block3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh ipsec static set policy name=netbc assign=y2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=netbc assign=y3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im msiexev.exe2⤵
- System Location Discovery: System Language Discovery
PID:532 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msiexev.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Chrome"2⤵
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Chrome"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2464
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Windriver"2⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Windriver"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Chrome" dir=in program="%PROGRAMFILES%\Google\Chrome\Application\chrome.txt" action=allow2⤵
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Chrome" dir=in program="C:\Program Files (x86)\Google\Chrome\Application\chrome.txt" action=allow3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Windriver" dir=in program="%PROGRAMFILES%\Hardware Driver Management\windriver.exe" action=allow2⤵
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Windriver" dir=in program="C:\Program Files (x86)\Hardware Driver Management\windriver.exe" action=allow3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:516
-
-
-
C:\Windows\Fonts\wuauser.exeC:\Windows\Fonts\wuauser.exe --server1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵
- System Location Discovery: System Language Discovery
PID:728 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im hdmanager.exe2⤵
- System Location Discovery: System Language Discovery
PID:4996 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hdmanager.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-