Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
privatools-files.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
privatools-files.rar
Resource
win10v2004-20241007-en
General
-
Target
privatools-files.rar
-
Size
81.6MB
-
MD5
98c2ceda9dbf52164fff822da4cd21e8
-
SHA1
c4a454397bd1b3dbce114136aa15d02cf8fb3753
-
SHA256
be6ac2cd293e28b25337d64551f8893d97068cef5c3fd012fb0e133073f64f7b
-
SHA512
c17dfad8109b5df9da6d34083526e8a3954c132d2b07b608baf3d3f6f5f9568208804e67f82cb28553a372d564ad088a931dc97b606189e3c9e643891f85e7db
-
SSDEEP
1572864:3XKdIwet6E4RetXLvBZ757eNB6sYjEA62g0+8WI7c0OUjPU4SK16TxfRKpSJ:36dIwet63c9vBd5M0ZSF0+KwPUjPLRmf
Malware Config
Signatures
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Exelastealer family
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2804 netsh.exe 2044 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation loader.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 1412 powershell.exe 1592 cmd.exe -
Executes dropped EXE 5 IoCs
pid Process 3484 loader.exe 2684 load.exe 4700 loader.exe 1540 loader.exe 3476 Stub.exe -
Loads dropped DLL 36 IoCs
pid Process 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe 3476 Stub.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 29 discord.com 30 discord.com 31 discord.com 51 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 27 ipinfo.io 28 ipinfo.io 41 ip-api.com -
pid Process 420 cmd.exe 4752 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 4136 tasklist.exe 2328 tasklist.exe 1152 tasklist.exe 4572 tasklist.exe 860 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 3736 cmd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2592 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 532 cmd.exe 1140 netsh.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 3188 NETSTAT.EXE -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 4504 WMIC.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 420 WMIC.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4036 ipconfig.exe 3188 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4408 systeminfo.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2832 7zFM.exe 2832 7zFM.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe 1540 loader.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2832 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2832 7zFM.exe Token: 35 2832 7zFM.exe Token: SeSecurityPrivilege 2832 7zFM.exe Token: SeDebugPrivilege 1540 loader.exe Token: SeIncreaseQuotaPrivilege 2804 WMIC.exe Token: SeSecurityPrivilege 2804 WMIC.exe Token: SeTakeOwnershipPrivilege 2804 WMIC.exe Token: SeLoadDriverPrivilege 2804 WMIC.exe Token: SeSystemProfilePrivilege 2804 WMIC.exe Token: SeSystemtimePrivilege 2804 WMIC.exe Token: SeProfSingleProcessPrivilege 2804 WMIC.exe Token: SeIncBasePriorityPrivilege 2804 WMIC.exe Token: SeCreatePagefilePrivilege 2804 WMIC.exe Token: SeBackupPrivilege 2804 WMIC.exe Token: SeRestorePrivilege 2804 WMIC.exe Token: SeShutdownPrivilege 2804 WMIC.exe Token: SeDebugPrivilege 2804 WMIC.exe Token: SeSystemEnvironmentPrivilege 2804 WMIC.exe Token: SeRemoteShutdownPrivilege 2804 WMIC.exe Token: SeUndockPrivilege 2804 WMIC.exe Token: SeManageVolumePrivilege 2804 WMIC.exe Token: 33 2804 WMIC.exe Token: 34 2804 WMIC.exe Token: 35 2804 WMIC.exe Token: 36 2804 WMIC.exe Token: SeIncreaseQuotaPrivilege 420 WMIC.exe Token: SeSecurityPrivilege 420 WMIC.exe Token: SeTakeOwnershipPrivilege 420 WMIC.exe Token: SeLoadDriverPrivilege 420 WMIC.exe Token: SeSystemProfilePrivilege 420 WMIC.exe Token: SeSystemtimePrivilege 420 WMIC.exe Token: SeProfSingleProcessPrivilege 420 WMIC.exe Token: SeIncBasePriorityPrivilege 420 WMIC.exe Token: SeCreatePagefilePrivilege 420 WMIC.exe Token: SeBackupPrivilege 420 WMIC.exe Token: SeRestorePrivilege 420 WMIC.exe Token: SeShutdownPrivilege 420 WMIC.exe Token: SeDebugPrivilege 420 WMIC.exe Token: SeSystemEnvironmentPrivilege 420 WMIC.exe Token: SeRemoteShutdownPrivilege 420 WMIC.exe Token: SeUndockPrivilege 420 WMIC.exe Token: SeManageVolumePrivilege 420 WMIC.exe Token: 33 420 WMIC.exe Token: 34 420 WMIC.exe Token: 35 420 WMIC.exe Token: 36 420 WMIC.exe Token: SeIncreaseQuotaPrivilege 420 WMIC.exe Token: SeSecurityPrivilege 420 WMIC.exe Token: SeTakeOwnershipPrivilege 420 WMIC.exe Token: SeLoadDriverPrivilege 420 WMIC.exe Token: SeSystemProfilePrivilege 420 WMIC.exe Token: SeSystemtimePrivilege 420 WMIC.exe Token: SeProfSingleProcessPrivilege 420 WMIC.exe Token: SeIncBasePriorityPrivilege 420 WMIC.exe Token: SeCreatePagefilePrivilege 420 WMIC.exe Token: SeBackupPrivilege 420 WMIC.exe Token: SeRestorePrivilege 420 WMIC.exe Token: SeShutdownPrivilege 420 WMIC.exe Token: SeDebugPrivilege 420 WMIC.exe Token: SeSystemEnvironmentPrivilege 420 WMIC.exe Token: SeRemoteShutdownPrivilege 420 WMIC.exe Token: SeUndockPrivilege 420 WMIC.exe Token: SeManageVolumePrivilege 420 WMIC.exe Token: 33 420 WMIC.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2832 7zFM.exe 2832 7zFM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2832 wrote to memory of 3484 2832 7zFM.exe 90 PID 2832 wrote to memory of 3484 2832 7zFM.exe 90 PID 3484 wrote to memory of 2684 3484 loader.exe 92 PID 3484 wrote to memory of 2684 3484 loader.exe 92 PID 3484 wrote to memory of 4700 3484 loader.exe 93 PID 3484 wrote to memory of 4700 3484 loader.exe 93 PID 4700 wrote to memory of 1540 4700 loader.exe 95 PID 4700 wrote to memory of 1540 4700 loader.exe 95 PID 1540 wrote to memory of 456 1540 loader.exe 97 PID 1540 wrote to memory of 456 1540 loader.exe 97 PID 2684 wrote to memory of 3476 2684 load.exe 96 PID 2684 wrote to memory of 3476 2684 load.exe 96 PID 3476 wrote to memory of 932 3476 Stub.exe 133 PID 3476 wrote to memory of 932 3476 Stub.exe 133 PID 3476 wrote to memory of 2184 3476 Stub.exe 101 PID 3476 wrote to memory of 2184 3476 Stub.exe 101 PID 3476 wrote to memory of 388 3476 Stub.exe 180 PID 3476 wrote to memory of 388 3476 Stub.exe 180 PID 3476 wrote to memory of 3680 3476 Stub.exe 104 PID 3476 wrote to memory of 3680 3476 Stub.exe 104 PID 3476 wrote to memory of 948 3476 Stub.exe 106 PID 3476 wrote to memory of 948 3476 Stub.exe 106 PID 2184 wrote to memory of 420 2184 cmd.exe 144 PID 2184 wrote to memory of 420 2184 cmd.exe 144 PID 388 wrote to memory of 2804 388 cmd.exe 173 PID 388 wrote to memory of 2804 388 cmd.exe 173 PID 948 wrote to memory of 4136 948 cmd.exe 111 PID 948 wrote to memory of 4136 948 cmd.exe 111 PID 3476 wrote to memory of 4408 3476 Stub.exe 148 PID 3476 wrote to memory of 4408 3476 Stub.exe 148 PID 4408 wrote to memory of 640 4408 cmd.exe 114 PID 4408 wrote to memory of 640 4408 cmd.exe 114 PID 3476 wrote to memory of 1976 3476 Stub.exe 115 PID 3476 wrote to memory of 1976 3476 Stub.exe 115 PID 3476 wrote to memory of 4440 3476 Stub.exe 116 PID 3476 wrote to memory of 4440 3476 Stub.exe 116 PID 1976 wrote to memory of 2072 1976 cmd.exe 119 PID 1976 wrote to memory of 2072 1976 cmd.exe 119 PID 4440 wrote to memory of 2328 4440 cmd.exe 120 PID 4440 wrote to memory of 2328 4440 cmd.exe 120 PID 3476 wrote to memory of 3736 3476 Stub.exe 121 PID 3476 wrote to memory of 3736 3476 Stub.exe 121 PID 3736 wrote to memory of 2784 3736 cmd.exe 123 PID 3736 wrote to memory of 2784 3736 cmd.exe 123 PID 3476 wrote to memory of 4904 3476 Stub.exe 124 PID 3476 wrote to memory of 4904 3476 Stub.exe 124 PID 3476 wrote to memory of 3608 3476 Stub.exe 125 PID 3476 wrote to memory of 3608 3476 Stub.exe 125 PID 3608 wrote to memory of 1152 3608 cmd.exe 128 PID 3608 wrote to memory of 1152 3608 cmd.exe 128 PID 4904 wrote to memory of 2172 4904 cmd.exe 129 PID 4904 wrote to memory of 2172 4904 cmd.exe 129 PID 3476 wrote to memory of 2084 3476 Stub.exe 130 PID 3476 wrote to memory of 2084 3476 Stub.exe 130 PID 3476 wrote to memory of 1244 3476 Stub.exe 131 PID 3476 wrote to memory of 1244 3476 Stub.exe 131 PID 3476 wrote to memory of 932 3476 Stub.exe 133 PID 3476 wrote to memory of 932 3476 Stub.exe 133 PID 3476 wrote to memory of 1592 3476 Stub.exe 134 PID 3476 wrote to memory of 1592 3476 Stub.exe 134 PID 2084 wrote to memory of 4364 2084 cmd.exe 138 PID 2084 wrote to memory of 4364 2084 cmd.exe 138 PID 4364 wrote to memory of 2664 4364 cmd.exe 139 PID 4364 wrote to memory of 2664 4364 cmd.exe 139 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2784 attrib.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\privatools-files.rar"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\7zO01B08C97\loader.exe"C:\Users\Admin\AppData\Local\Temp\7zO01B08C97\loader.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Roaming\load.exe"C:\Users\Admin\AppData\Roaming\load.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\onefile_2684_133817891500163399\Stub.exeC:\Users\Admin\AppData\Roaming\load.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵PID:932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"5⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"5⤵PID:3680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
PID:4136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"5⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer6⤵PID:640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:2072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
PID:2328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe""5⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe"6⤵
- Views/modifies file attributes
PID:2784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""5⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"6⤵PID:2172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
PID:1152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"5⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\system32\cmd.execmd.exe /c chcp6⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\system32\chcp.comchcp7⤵PID:2664
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"5⤵PID:1244
-
C:\Windows\system32\cmd.execmd.exe /c chcp6⤵PID:3004
-
C:\Windows\system32\chcp.comchcp7⤵PID:5012
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵PID:932
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
PID:4572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"5⤵
- Clipboard Data
PID:1592 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard6⤵
- Clipboard Data
PID:1412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"5⤵
- Network Service Discovery
PID:420 -
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
PID:4408
-
-
C:\Windows\system32\HOSTNAME.EXEhostname6⤵PID:3824
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername6⤵
- Collects information from the system
PID:4504
-
-
C:\Windows\system32\net.exenet user6⤵PID:1452
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user7⤵PID:652
-
-
-
C:\Windows\system32\query.exequery user6⤵PID:2652
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"7⤵PID:4980
-
-
-
C:\Windows\system32\net.exenet localgroup6⤵PID:3272
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup7⤵PID:2864
-
-
-
C:\Windows\system32\net.exenet localgroup administrators6⤵PID:4516
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators7⤵PID:3808
-
-
-
C:\Windows\system32\net.exenet user guest6⤵PID:4388
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest7⤵PID:4484
-
-
-
C:\Windows\system32\net.exenet user administrator6⤵PID:556
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator7⤵PID:464
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command6⤵PID:2696
-
-
C:\Windows\system32\tasklist.exetasklist /svc6⤵
- Enumerates processes with tasklist
PID:860
-
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
PID:4036
-
-
C:\Windows\system32\ROUTE.EXEroute print6⤵PID:1620
-
-
C:\Windows\system32\ARP.EXEarp -a6⤵
- Network Service Discovery
PID:4752
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano6⤵
- System Network Connections Discovery
- Gathers network information
PID:3188
-
-
C:\Windows\system32\sc.exesc query type= service state= all6⤵
- Launches sc.exe
PID:2592
-
-
C:\Windows\system32\netsh.exenetsh firewall show state6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2804
-
-
C:\Windows\system32\netsh.exenetsh firewall show config6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:532 -
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:1772
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:3684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵PID:2488
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵PID:388
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\loader.exe"C:\Users\Admin\AppData\Roaming\loader.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\onefile_4700_133817891504069927\loader.exe"C:\Users\Admin\AppData\Roaming\loader.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "start privatools.exe"5⤵PID:456
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1System Information Discovery
5System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43.8MB
MD5b24f88f0db403ac11a78716ff320deb4
SHA19c8d20371469ea36e3587b7ab63f523b8bfd4648
SHA2562fc809e60498653ef870494366d1d633eed8244332f6bdb14aefaeef1032db44
SHA5127ca0790b1413d55e623157de8cdd7542d1cd78bd0464cf71c66f617a4332dbf6bb9e8cc2ac01cd70cbd342e995504f96dac38368a17979ce256a0b4724725c06
-
Filesize
63KB
MD5686262283ba69cce7f3eaba7cdeb0372
SHA15b771e444ee97b246545affcdc8fa910c8f591ea
SHA25602ec5cd22543c0ca298c598b7e13949a4e8247cec288d0bca0a1269059b548ef
SHA512dca7403cfe2bfe14cf51f747a893f49db52d4d43691dbccecaa83796351b6f7e644cf8e455a0b9c38c6c006f481d5c45d32ae789756250a2b29978e9feb839d0
-
Filesize
81KB
MD556203038756826a0a683d5750ee04093
SHA193d5a07f49bdcc7eb8fba458b2428fe4afcc20d2
SHA25631c2f21adf27ca77fa746c0fda9c7d7734587ab123b95f2310725aaf4bf4ff3c
SHA5123da5ae98511300694c9e91617c152805761d3de567981b5ab3ef7cd3dbba3521aae0d49b1eb42123d241b5ed13e8637d5c5bc1b44b9eaa754657f30662159f3a
-
Filesize
77KB
MD5c389430e19f1cd4c2e7b8538e8c52459
SHA1546ed5a85ad80a7b7db99f80c7080dc972e4f2a2
SHA256a14efa68d8f7ec018fb867a6ba6c6c290a803b4001fd8c45db7bda66fb700067
SHA5125bef6c90c65bf1d4be0ce0d0cb3f38fe288f5716c93e444cf12f89f066791850d8316d414f1d795ff148c9e841cda90ef9c35ceb4a499563f28d068a6b427671
-
Filesize
46KB
MD595463f615865a472f75ddb365644a571
SHA191f22ef3f2ffd3e9d6ce6e58beea9a96287b090b
SHA2569ee77474d244a17337d4ccc5113fe4af7b4d86f9969293a884927718d06e63c8
SHA512e3cccce9ebf5e7cf33e68046d3e7b59e454ccb791635eb5f405977fd270126ef8b58e6288dbe58c96b681361d81ef28720eba8d0bd389bfb0f4c3114d098a117
-
Filesize
29KB
MD5c6ef07e75eae2c147042d142e23d2173
SHA16ef3e912db5faf5a6b4225dbb6e34337a2271a60
SHA25643ee736c8a93e28b1407bf5e057a7449f16ee665a6e51a0f1bc416e13cee7e78
SHA51230e915566e7b934bdd49e708151c98f732ff338d7bc3a46797de9cca308621791276ea03372c5e2834b6b55e66e05d58cf1bb4cb9ff31fb0a1c1aca0fcdc0d45
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
120KB
MD5462fd515ca586048459b9d90a660cb93
SHA106089f5d5e2a6411a0d7b106d24d5203eb70ec60
SHA256bf017767ac650420487ca3225b3077445d24260bf1a33e75f7361b0c6d3e96b4
SHA51267851bdbf9ba007012b89c89b86fd430fce24790466fefbb54431a7c200884fc9eb2f90c36d57acd300018f607630248f1a3addc2aa5f212458eb7a5c27054b3
-
Filesize
63KB
MD57a74284813386818ada7bf55c8d8acf9
SHA1380c4184eec7ca266e4c2b96bb92a504dfd8fe5f
SHA25621a1819013de423bb3b9b682d0b3506c6ef57ee88c61edf4ba12d8d5f589c9c2
SHA512f8bc4ac57ada754006bbbb0bfa1ccb6c659f9c4d3270970e26219005e872b60afb9242457d8eb3eae0ce1f608f730da3bf16715f04b47bea4c95519dd9994a46
-
Filesize
154KB
MD514ea9d8ba0c2379fb1a9f6f3e9bbd63b
SHA1f7d4e7b86acaf796679d173e18f758c1e338de82
SHA256c414a5a418c41a7a8316687047ed816cad576741bd09a268928e381a03e1eb39
SHA51264a52fe41007a1cac4afedf2961727b823d7f1c4399d3465d22377b5a4a5935cee2598447aeff62f99c4e98bb3657cfae25b5c27de32107a3a829df5a25ba1ce
-
Filesize
48KB
MD5a5bd529290006ef1ebc8d32ffe501ca5
SHA1c59ef2157358fb8f79b5a37ee9abba802ae915ba
SHA256eeaa26addf211b37e689d46cfac6b7fad0d5421adc4c0113872dac1347aff130
SHA5126b026e62b0b37445a480599175161cf6a60284ef881e0f0d1da643ac80013c2005f790f099733d76cfcf855e2ecd3a0e6c8bfc19dbabff67869119676ee03b73
-
Filesize
96KB
MD598228631212a443781d0ac72e4656b97
SHA17e87e1fb891439cf466648b37abdbd4053a5da66
SHA256fab3440d88376c9c334333b80b50f20a273a08f1d319bf0a9a6eb8bd04d35250
SHA5125d41384b0280415f581c13b4b47de3de845fd60fc0373613dc9a73d4e0ecf9e855cb0e4aaa1c88fdc2d98e973ca083a48c129529141a8fd65c74c104ad9015f0
-
Filesize
156KB
MD57c7223f28c0c27c85a979ad222d19288
SHA14185e671b1dc56b22134c97cd8a4a67747887b87
SHA2564ec47beadc4fd0d38fa39092244c108674012874f3190ee0e484aa988b94f986
SHA512f3e813b954357f1bc323d897edf308a99ed30ff451053b312f81b6baae188cda58d144072627398a19d8d12fe659e4f40636dbbdf22a45770c3ca71746ec2df0
-
Filesize
3.3MB
MD580b72c24c74d59ae32ba2b0ea5e7dad2
SHA175f892e361619e51578b312605201571bfb67ff8
SHA256eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d
SHA51208014ee480b5646362c433b82393160edf9602e4654e12cd9b6d3c24e98c56b46add9bf447c2301a2b2e782f49c444cb8e37ee544f38330c944c87397bdd152a
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
686KB
MD586f2d9cc8cc54bbb005b15cabf715e5d
SHA1396833cba6802cb83367f6313c6e3c67521c51ad
SHA256d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771
SHA5120013d487173b42e669a13752dc8a85b838c93524f976864d16ec0d9d7070d981d129577eda497d4fcf66fc6087366bd320cff92ead92ab79cfcaa946489ac6cb
-
Filesize
4.3MB
MD5e4533934b37e688106beac6c5919281e
SHA1ada39f10ef0bbdcf05822f4260e43d53367b0017
SHA2562bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5
SHA512fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9
-
Filesize
1.5MB
MD5fcc7a468d46c90f5a71e3e9c99b1d50e
SHA191070cac3cdde28905a7bc695f8c0fd1290fd0d0
SHA256215c02ac57378e48428d4b013f7bcedd2b58d73e83c54eca17a8c9bd7f3bdf55
SHA51295bff194696436e590a5df8f18987ce6e5c20b6e50e552e7d049fec8da834c71cdbd87418fc85be73aaea4176aeb672d44e89256cd64bfade5959f3aabb0884d
-
Filesize
1.1MB
MD5d4964a28a22078c30064c65e968f9e1f
SHA1b9b95975bea97a55c888da66148d54bdb38b609b
SHA256b204718d21952369726472ca12712047839119ccf87e16979af595c0a57b6703
SHA512bfe200b255ae1ddba53d98d54479e7e1d0932fb27bbfdcb4170d3d4cbbbfc297e3b5fd273b830399b795feb64cd0d9c48d0e1e0eaf72d0e0992261864e2d7296
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
120KB
MD56a9ca97c039d9bbb7abf40b53c851198
SHA101bcbd134a76ccd4f3badb5f4056abedcff60734
SHA256e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
SHA512dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d
-
Filesize
76KB
MD58140bdc5803a4893509f0e39b67158ce
SHA1653cc1c82ba6240b0186623724aec3287e9bc232
SHA25639715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
SHA512d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826
-
Filesize
34KB
MD532d36d2b0719db2b739af803c5e1c2f5
SHA1023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA256128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
SHA512a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1
-
Filesize
8.5MB
MD525c312f4da3222a68d209c91945adda8
SHA125cfa08c17e2c97e61bd4819a3f4aac03f80ddf5
SHA2561fb6e99be149836379a93738c525c809cd30bda46330a49a3601c8e9b3372aba
SHA512aba55518bedda5bdec190635e100ef1cea6e9823ff0ecfbad742aa603270e4da39e2a1fe8df3beebcc633b362d0c61738bcf5003a6145fd5d68f5e2313df5382
-
Filesize
76KB
MD5ebefbc98d468560b222f2d2d30ebb95c
SHA1ee267e3a6e5bed1a15055451efcccac327d2bc43
SHA25667c17558b635d6027ddbb781ea4e79fc0618bbec7485bd6d84b0ebcd9ef6a478
SHA512ab9f949adfe9475b0ba8c37fa14b0705923f79c8a10b81446abc448ad38d5d55516f729b570d641926610c99df834223567c1efde166e6a0f805c9e2a35556e3
-
Filesize
64KB
MD534e49bb1dfddf6037f0001d9aefe7d61
SHA1a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA2564055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
-
Filesize
28KB
MD597ee623f1217a7b4b7de5769b7b665d6
SHA195b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA2560046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
SHA51220edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f
-
Filesize
38.5MB
MD5b72ffc0e6d94d011ddad9018285049e6
SHA177c84dab48fa2fc633fde8ad8675900e48209839
SHA25609b5cbb3c2ac46e0ed298bed4ff08b87ea437dd13b71883b1b087b0a0bdb7f6d
SHA5126da0259e6eb89ce1187f9531c6eabd023215e12077dccffffa72172571cb991a5146f3964c696cb419fdd3cc89306bfaf20db80a96d4ef0a8206dce3d24bbc3e
-
Filesize
5.3MB
MD58106fe1bba482da9cf1436a1fac73230
SHA12eea03f71155c437875d00a9c8de052689dcb824
SHA256c5e0a4e8bcb73aa7b6da814ac986d07836f87aa70af84620087eaa8ccb680ff7
SHA512a98e7452ecbf0a4493da4d471b719f5c2e88d0526a9b1a9ac7ed3eda1c131401184c425f3b858d588e2b75d5747e47671e7a4d2f04c8071d847f9721dc19bdad