3821a8054e127d660e9ac82eb46586fe5a7e185427f127cb599e08ceabe4f48b

Analysis

user interaction
yes
max time kernel
26s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1UkITMlMfePF.exe
Size 39.3MB
Sample260628-ja3fhags2q
SHA256 3821a8054e127d660e9ac82eb46586fe5a7e185427f127cb599e08ceabe4f48b
MD5 49ce9dadba4f5dcbc4331e63f58dd9d5
SHA1 6be2fded4e4f7df596cdc3808798e992eee1536b
SHA512 1d64329b5afddbcb3be57cf2b1c3cca72de07484c178e344623bc992f4112208714b4a82e090aa9f071923c6640a85ce8c861872fc93bb5a36925464866e40c7
SSDEEP 786432:g5kMTXU4mLw5X7XHsXRIPaHIwHqvl/kARCqzm6bNKbRjIvwdVnb4CQb:g57TXDmLw5wBgaoQWXbKbRMvynb41b
TLSH
T10497332D6B20AFB2C1A4E835CE58B78753E0E25CC3EE948D788258FBCA5677E4757110
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion persistence trojan

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1UkITMlMfePF.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1UkITMlMfePF.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	1UkITMlMfePF.exe

Modifies Windows Firewall 2 TTPs 27 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3404	netsh.exe
3168	netsh.exe
3820	netsh.exe
1248	netsh.exe
3136	netsh.exe
3168	netsh.exe
4356	netsh.exe
4344	netsh.exe
3340	netsh.exe
5944	netsh.exe
5880	netsh.exe
2096	netsh.exe
5028	netsh.exe
4804	netsh.exe
4960	netsh.exe
5724	netsh.exe
6000	netsh.exe
1636	netsh.exe
1540	netsh.exe
5124	netsh.exe
3480	netsh.exe
2260	netsh.exe
3444	netsh.exe
756	netsh.exe
3008	netsh.exe
264	netsh.exe
3392	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1UkITMlMfePF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1UkITMlMfePF.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1UkITMlMfePF.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	1UkITMlMfePF.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\cmd.exe	1UkITMlMfePF.exe
File created	C:\Windows\System32\netsh.exe	1UkITMlMfePF.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3432	1UkITMlMfePF.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe
3432	1UkITMlMfePF.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3432	1UkITMlMfePF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	1UkITMlMfePF.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 5756	3432	1UkITMlMfePF.exe	90
PID 3432 wrote to memory of 2480	3432	1UkITMlMfePF.exe	91
PID 3432 wrote to memory of 5556	3432	1UkITMlMfePF.exe	92
PID 3432 wrote to memory of 4772	3432	1UkITMlMfePF.exe	93

C:\Users\Admin\AppData\Local\Temp\1UkITMlMfePF.exe
"C:\Users\Admin\AppData\Local\Temp\1UkITMlMfePF.exe"
1⤵
- Modifies visibility of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:5756
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:756
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:4884
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy reset >nul 2>&1
  2⤵
  PID:2480
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy reset
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:5556
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:3008
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:1984
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:5992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:1292
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:5880
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:3012
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp >nul 2>&1
  2⤵
  PID:3108
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on >nul 2>&1
  2⤵
  PID:4532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1 >nul 2>&1
  2⤵
  PID:2800
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1
    3⤵
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on >nul 2>&1
  2⤵
  PID:3512
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on >nul 2>&1
  2⤵
  PID:2532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 107.189.19.215 (Inbound)" | findstr 107.189.19.215 >nul 2>&1
  2⤵
  PID:3140
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 107.189.19.215 (Inbound)"
    3⤵
    - Modifies Windows Firewall
    PID:2096
- - C:\Windows\system32\findstr.exe
    findstr 107.189.19.215
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700 >nul 2>&1
  2⤵
  PID:3644
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700
    3⤵
    PID:5968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="CRYPTAUTH 107.189.19.215 (Inbound)" dir=in action=block remoteip=107.189.19.215 enable=yes >nul 2>&1
  2⤵
  PID:4692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="CRYPTAUTH 107.189.19.215 (Inbound)" dir=in action=block remoteip=107.189.19.215 enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49 >nul 2>&1
  2⤵
  PID:5832
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 107.189.19.215" | findstr 107.189.19.215 >nul 2>&1
  2⤵
  PID:4288
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 107.189.19.215"
    3⤵
    - Modifies Windows Firewall
    PID:5028
- - C:\Windows\system32\findstr.exe
    findstr 107.189.19.215
    3⤵
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:5768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:1540
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:1776
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223 >nul 2>&1
  2⤵
  PID:4852
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223
    3⤵
    PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22 >nul 2>&1
  2⤵
  PID:1300
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22
    3⤵
    PID:5980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f >nul 2>&1
  2⤵
  PID:1424
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f
    3⤵
    PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy show all
  2⤵
  PID:2864
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy show all
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy reset >nul 2>&1
  2⤵
  PID:2936
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy reset
    3⤵
    PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp >nul 2>&1
  2⤵
  PID:5852
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1 >nul 2>&1
  2⤵
  PID:4604
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1
    3⤵
    PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700 >nul 2>&1
  2⤵
  PID:5992
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700
    3⤵
    PID:3092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49 >nul 2>&1
  2⤵
  PID:2596
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49
    3⤵
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223 >nul 2>&1
  2⤵
  PID:5060
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223
    3⤵
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22 >nul 2>&1
  2⤵
  PID:2720
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22
    3⤵
    PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f >nul 2>&1
  2⤵
  PID:2016
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f
    3⤵
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy show all
  2⤵
  PID:2488
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy show all
    3⤵
    PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="CRYPTAUTH 107.189.19.215" dir=out action=block remoteip=107.189.19.215 enable=yes >nul 2>&1
  2⤵
  PID:700
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="CRYPTAUTH 107.189.19.215" dir=out action=block remoteip=107.189.19.215 enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:260
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:4804
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:4520
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy reset >nul 2>&1
  2⤵
  PID:2364
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy reset
    3⤵
    PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 3.110.33.34 (Inbound)" | findstr 3.110.33.34 >nul 2>&1
  2⤵
  PID:4676
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 3.110.33.34 (Inbound)"
    3⤵
    - Modifies Windows Firewall
    PID:3820
- - C:\Windows\system32\findstr.exe
    findstr 3.110.33.34
    3⤵
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:2152
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:4960
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:2432
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp >nul 2>&1
  2⤵
  PID:1204
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="CRYPTAUTH 3.110.33.34 (Inbound)" dir=in action=block remoteip=3.110.33.34 enable=yes >nul 2>&1
  2⤵
  PID:1920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="CRYPTAUTH 3.110.33.34 (Inbound)" dir=in action=block remoteip=3.110.33.34 enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:1088
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:6000
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:1484
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1 >nul 2>&1
  2⤵
  PID:5272
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1
    3⤵
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 3.110.33.34" | findstr 3.110.33.34 >nul 2>&1
  2⤵
  PID:3504
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 3.110.33.34"
    3⤵
    - Modifies Windows Firewall
    PID:1636
- - C:\Windows\system32\findstr.exe
    findstr 3.110.33.34
    3⤵
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700 >nul 2>&1
  2⤵
  PID:2580
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="CRYPTAUTH 3.110.33.34" dir=out action=block remoteip=3.110.33.34 enable=yes >nul 2>&1
  2⤵
  PID:3848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="CRYPTAUTH 3.110.33.34" dir=out action=block remoteip=3.110.33.34 enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49 >nul 2>&1
  2⤵
  PID:1340
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:1740
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:5124
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:4384
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:2644
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:4356
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:6064
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223 >nul 2>&1
  2⤵
  PID:4756
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223
    3⤵
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 176.40.106.133 (Inbound)" | findstr 176.40.106.133 >nul 2>&1
  2⤵
  PID:4876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 176.40.106.133 (Inbound)"
    3⤵
    - Modifies Windows Firewall
    PID:3480
- - C:\Windows\system32\findstr.exe
    findstr 176.40.106.133
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22 >nul 2>&1
  2⤵
  PID:1700
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22
    3⤵
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="CRYPTAUTH 176.40.106.133 (Inbound)" dir=in action=block remoteip=176.40.106.133 enable=yes >nul 2>&1
  2⤵
  PID:3116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="CRYPTAUTH 176.40.106.133 (Inbound)" dir=in action=block remoteip=176.40.106.133 enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:2148
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:2260
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:2556
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f >nul 2>&1
  2⤵
  PID:4620
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f
    3⤵
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 176.40.106.133" | findstr 176.40.106.133 >nul 2>&1
  2⤵
  PID:3268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 176.40.106.133"
    3⤵
    - Modifies Windows Firewall
    PID:4344
- - C:\Windows\system32\findstr.exe
    findstr 176.40.106.133
    3⤵
    PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy show all
  2⤵
  PID:4352
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy show all
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  PID:3972
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:3444
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:2392
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="CRYPTAUTH 176.40.106.133" dir=out action=block remoteip=176.40.106.133 enable=yes >nul 2>&1
  2⤵
  PID:4248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="CRYPTAUTH 176.40.106.133" dir=out action=block remoteip=176.40.106.133 enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy reset >nul 2>&1
  2⤵
  PID:3616
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy reset
    3⤵
    PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp >nul 2>&1
  2⤵
  PID:4860
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    PID:4708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 172.86.94.120 (Inbound)" | findstr 172.86.94.120 >nul 2>&1
  2⤵
  PID:4664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 172.86.94.120 (Inbound)"
    3⤵
    - Modifies Windows Firewall
    PID:5944
- - C:\Windows\system32\findstr.exe
    findstr 172.86.94.120
    3⤵
    PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1 >nul 2>&1
  2⤵
  PID:1288
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1
    3⤵
    PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3088

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3300
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:1688

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3544

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoofer[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AMNPKN0B\spoofer[1].htm
Size 30B
SHA256 37d165c3c22e35a27cd82203a3a68796b9cac67c0a6540d0e5471e328c10460e
MD5 f24325abf1d03437864e333dab836a8a
SHA1 009d4cb08b729ed26fd362d1beaad839847a2086
SHA512 4299dd7b507c8847f1444c26bdf02148803e4b23b965e9b69f05487879901dce604627c9e6b5464b27665057d920e7fd8e8ce6b43d555a05a2da7b780214ca25
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 c816b44762802a72fb687d66203d2a920087ab92dd60b59e52e5c63d003f0e2e
MD5 77f9c1b8812695ad246b5d5ff041d30c
SHA1 acc5bb57d7531864bcab260ffad0eb5be9977625
SHA512 9ce18ab93a5b906bc4dec41f09c7e78d2991e4359b9e7f8ee67414d7ced6d5df2c7808bd72a97b641a445db7ddb4a468d13d3fb526f606bf009377ada1a744fe
TLSH
T1FA2138C78E9AD2A5C362C2418975D015920750D10F9656EDB1CCFCAD3343739A684FF7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3432-6-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-539-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-7-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-0-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-4-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-47-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-68-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-137-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-222-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-282-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-749-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-689-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-626-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-2-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-5-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3432-3-0x0000000140000000-0x0000000145EE5000-memory.dmp

Download

memory/3544-348-0x0000021F81D40000-0x0000021F81E40000-memory.dmp

Download

memory/3544-331-0x0000021F801E0000-0x0000021F802E0000-memory.dmp

Download

memory/3544-346-0x0000021F81920000-0x0000021F81940000-memory.dmp

Download

memory/3544-364-0x0000021F81B60000-0x0000021F81B80000-memory.dmp

Download

memory/3544-379-0x0000021F946E0000-0x0000021F94700000-memory.dmp

Download

memory/5696-571-0x000001C100000000-0x000001C1000FF000-memory.dmp

Download

memory/5696-646-0x000001C100000000-0x000001C1000FF000-memory.dmp

Download

memory/5696-708-0x000001C100000000-0x000001C1000FF000-memory.dmp

Download