fog | fa0f043bb9f700063a5dc388322de207e08b53886b4112a5cb0bab26d5ee91aa

Analysis

max time kernel
149s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
13/10/2025, 19:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
l.exe
Size 103KB
Sample251013-xnnfdshr7t
SHA256 b6c1ee0c0a7b9a88d6cffaf90c950b7e0e96a841cc3e37c5242f6bff2a1c8202
MD5 6195c398e48d65c5e33278a01089a45b
SHA1 6f8308c45f3dcc6c3c1a26b7b5a429dc1514d107
SHA512 cfe7b82895f31164ef93e1067c7af14acd63641bc3c8b46aa6ef8849575ee1f572d182d12f60a08cce9eaf961421613f59f799efa971bfb286371fd354697ab7
SSDEEP 3072:FwNiEMgu56nQZ3GWctLiIALi3S7LMU6NQaJ:FwNijgu56Q9qtLgHMppJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery fog persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ClickToRun\readme.txt

Ransom Note

If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 58XMS26R7R3D031KKJH0HA7N 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.

URLs

http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion
http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Signatures

Fog Ransomware
Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.
ransomware fog
Fog family
fog
Renames multiple (1787) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3404	netsh.exe
3452	netsh.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3228	cmd.exe
5104	ARP.EXE

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2568	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.flocked	l.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.flocked	l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.flocked	l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.flocked	l.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\readme.txt	l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.flocked	l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.flocked	l.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt.flocked	l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt.flocked	l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.flocked	l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.flocked	l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.flocked	l.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.flocked	l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.flocked	l.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\readme.txt	l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.flocked	l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr.jar.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.flocked	l.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\readme.txt	l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.flocked	l.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ca-ES\readme.txt	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.flocked	l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.flocked	l.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\readme.txt	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.flocked	l.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\readme.txt	l.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\lt.pak.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.flocked	l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.flocked	l.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.flocked	l.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt.flocked	l.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\readme.txt	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.flocked	l.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.flocked	l.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOSTNAME.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4420	cmd.exe
4948	NETSTAT.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2188	ipconfig.exe
4948	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5964	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5392	l.exe
5392	l.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	NETSTAT.EXE
Token: SeDebugPrivilege	2568	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 5160	5392	l.exe	78
PID 5392 wrote to memory of 5160	5392	l.exe	78
PID 5392 wrote to memory of 5160	5392	l.exe	78
PID 5160 wrote to memory of 2596	5160	cmd.exe	80
PID 5160 wrote to memory of 2596	5160	cmd.exe	80
PID 5160 wrote to memory of 2596	5160	cmd.exe	80
PID 2596 wrote to memory of 3944	2596	net.exe	81
PID 2596 wrote to memory of 3944	2596	net.exe	81
PID 2596 wrote to memory of 3944	2596	net.exe	81
PID 5392 wrote to memory of 1472	5392	l.exe	82
PID 5392 wrote to memory of 1472	5392	l.exe	82
PID 5392 wrote to memory of 1472	5392	l.exe	82
PID 1472 wrote to memory of 5964	1472	cmd.exe	84
PID 1472 wrote to memory of 5964	1472	cmd.exe	84
PID 1472 wrote to memory of 5964	1472	cmd.exe	84
PID 5392 wrote to memory of 4780	5392	l.exe	87
PID 5392 wrote to memory of 4780	5392	l.exe	87
PID 5392 wrote to memory of 4780	5392	l.exe	87
PID 4780 wrote to memory of 4864	4780	cmd.exe	89
PID 4780 wrote to memory of 4864	4780	cmd.exe	89
PID 4780 wrote to memory of 4864	4780	cmd.exe	89
PID 5392 wrote to memory of 4896	5392	l.exe	90
PID 5392 wrote to memory of 4896	5392	l.exe	90
PID 5392 wrote to memory of 4896	5392	l.exe	90
PID 4896 wrote to memory of 5008	4896	cmd.exe	92
PID 4896 wrote to memory of 5008	4896	cmd.exe	92
PID 4896 wrote to memory of 5008	4896	cmd.exe	92
PID 5008 wrote to memory of 4336	5008	net.exe	93
PID 5008 wrote to memory of 4336	5008	net.exe	93
PID 5008 wrote to memory of 4336	5008	net.exe	93
PID 5392 wrote to memory of 5060	5392	l.exe	94
PID 5392 wrote to memory of 5060	5392	l.exe	94
PID 5392 wrote to memory of 5060	5392	l.exe	94
PID 5060 wrote to memory of 2188	5060	cmd.exe	96
PID 5060 wrote to memory of 2188	5060	cmd.exe	96
PID 5060 wrote to memory of 2188	5060	cmd.exe	96
PID 5392 wrote to memory of 3092	5392	l.exe	97
PID 5392 wrote to memory of 3092	5392	l.exe	97
PID 5392 wrote to memory of 3092	5392	l.exe	97
PID 3092 wrote to memory of 4596	3092	cmd.exe	99
PID 3092 wrote to memory of 4596	3092	cmd.exe	99
PID 3092 wrote to memory of 4596	3092	cmd.exe	99
PID 5392 wrote to memory of 3228	5392	l.exe	100
PID 5392 wrote to memory of 3228	5392	l.exe	100
PID 5392 wrote to memory of 3228	5392	l.exe	100
PID 3228 wrote to memory of 5104	3228	cmd.exe	102
PID 3228 wrote to memory of 5104	3228	cmd.exe	102
PID 3228 wrote to memory of 5104	3228	cmd.exe	102
PID 5392 wrote to memory of 4420	5392	l.exe	103
PID 5392 wrote to memory of 4420	5392	l.exe	103
PID 5392 wrote to memory of 4420	5392	l.exe	103
PID 4420 wrote to memory of 4948	4420	cmd.exe	105
PID 4420 wrote to memory of 4948	4420	cmd.exe	105
PID 4420 wrote to memory of 4948	4420	cmd.exe	105
PID 5392 wrote to memory of 2428	5392	l.exe	106
PID 5392 wrote to memory of 2428	5392	l.exe	106
PID 5392 wrote to memory of 2428	5392	l.exe	106
PID 2428 wrote to memory of 3404	2428	cmd.exe	108
PID 2428 wrote to memory of 3404	2428	cmd.exe	108
PID 2428 wrote to memory of 3404	2428	cmd.exe	108
PID 5392 wrote to memory of 5124	5392	l.exe	109
PID 5392 wrote to memory of 5124	5392	l.exe	109
PID 5392 wrote to memory of 5124	5392	l.exe	109
PID 5124 wrote to memory of 3452	5124	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\l.exe
"C:\Users\Admin\AppData\Local\Temp\l.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net config Workstation
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\SysWOW64\net.exe
    net config Workstation
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 config Workstation
      4⤵
      System Location Discovery: System Language Discovery
      PID:3944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c systeminfo
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers system information
    PID:5964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c hostname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\HOSTNAME.EXE
    hostname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net users
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\net.exe
    net users
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 users
      4⤵
      System Location Discovery: System Language Discovery
      PID:4336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c route print
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\ROUTE.EXE
    route print
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c arp -A
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\SysWOW64\ARP.EXE
    arp -A
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c netstat -ano
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c netsh firewall show state
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall show state
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c netsh firewall show config
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall show config
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c schtasks /query /fo LIST /v
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /query /fo LIST /v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c tasklist /SVC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /SVC
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4100
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c DRIVERQUERY
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1728
- - C:\Windows\SysWOW64\driverquery.exe
    DRIVERQUERY
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

readme.txt

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\readme.txt
Size 837B
SHA256 9b39cf062257deff5a19badd7ffb3886e573f7e2ee841cae120320ef05e4cc3c
MD5 dfb2e4352eeb77d02a858cadcdc987a4
SHA1 64d977375ce63234282b3a56d9554337e742d6ee
SHA512 1a670d33444987a6e82209dac750707d508380be77c8795d876f019b7577fd7c8a96453bc37d82ea1eff26cf164d7b0cb41c3b39b582ded558117b735f2316f3
MD5 SHA1 SHA512

Submit Download

DbgLog.sys

Path C:\Users\Admin\AppData\Local\Temp\DbgLog.sys
Size 7KB
SHA256 981ecdb2342d687234533cec9c75ec39834df5ad17fe1905026fffedfac7b592
MD5 a757d06ac8e8df4b6fc9e344de57980b
SHA1 c4fad12efa047d2d4376d56b7373f9e7c8fa2476
SHA512 32aedbfd9cda8fee064b5d5db9da45e59ab8f7b5fe61518b0721247f01e817990b568423ea53d281e1041dda8af9e5899f8e17b2b2464c7ec5bd6d47de1ec409
SSDEEP 96:5sHTtOpgy3DyKD03WeoyvnDae52w6xAO3X3Mb70Ma886Iqawdu+cmI:5sHTt8mKD0GeoonDZpq3fqawdub
MD5 SHA1 SHA512 SSDEEP

Submit Download

DbgLog.sys

Path C:\Users\Admin\AppData\Local\Temp\DbgLog.sys
Size 465B
SHA256 5dde0035c82931839a15e98c2713535b558d0966faf7451827f093741a38f0d0
MD5 628368304eaa0c468aeb59e3bd78174f
SHA1 9969fa2481985a8bb657b834c9ad0017afa89233
SHA512 af39df9a8e38ddd88f015fb380e43af36453886b6058ba519fdc617dabad92b4879c1de47bc08bdec0e3846d70b36cee0d759fbb662e3d545d42ccfec730377e
MD5 SHA1 SHA512

Submit Download