Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system -
submitted
14-02-2025 23:01
Behavioral task
behavioral1
Sample
4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe
Resource
win10v2004-20250211-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe
-
Size
93KB
-
MD5
9c58f76efce10297cfe0025e9fa379b9
-
SHA1
a8cc3aa5cd30dc6471d965248ebc9e99e38c4013
-
SHA256
4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d
-
SHA512
05f626ec4752e503c19139c20d275f16621e91d7d7383975a2b7ed91622df384f8376b04ce0dca79177da87b40f225a9f31a051b29bb1474585dd2d01b837c81
-
SSDEEP
768:kY3zgnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3bsGn:3gxOx6baIa9ROj00ljEwzGi1dDnDrgS
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 60 936 Process not Found -
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 1708 netsh.exe 1896 netsh.exe 3392 netsh.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe File opened for modification C:\autorun.inf 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe File created F:\autorun.inf 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe File opened for modification F:\autorun.inf 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2772 MicrosoftEdgeUpdate.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: 33 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe Token: SeIncBasePriorityPrivilege 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4568 wrote to memory of 1708 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 87 PID 4568 wrote to memory of 1708 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 87 PID 4568 wrote to memory of 1708 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 87 PID 4568 wrote to memory of 1896 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 89 PID 4568 wrote to memory of 1896 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 89 PID 4568 wrote to memory of 1896 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 89 PID 4568 wrote to memory of 3392 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 90 PID 4568 wrote to memory of 3392 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 90 PID 4568 wrote to memory of 3392 4568 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe"C:\Users\Admin\AppData\Local\Temp\4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe"1⤵
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe" "4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1708
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1896
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe" "4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3392
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTEyRTE5MzktQUExQS00QzE5LUE4NjgtRUE3RjYzQzMzODc2fSIgdXNlcmlkPSJ7MDFFQ0I3NkYtQjJEMC00MzkwLTgxMjktMTlEQjgzMjRFNkZDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTQ1NUQ0RUQtODdDNi00MTg5LTk5MzQtRTE0RkVEMzdFRDA5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mjk3MzYxMDkwIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2772
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1