68bad2fda125ec4c4e7c029f62756f83d6f58309ba484cfb151b6b3eea0f18f6

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wirevpn.exe
Size 8.2MB
Sample260702-a17cpsaw4v
SHA256 68bad2fda125ec4c4e7c029f62756f83d6f58309ba484cfb151b6b3eea0f18f6
MD5 6458265f48b9fb7f02ab3d0bfd335562
SHA1 05c25a81f4b6032445d0e4e0e09b0ea14cad722d
SHA512 6860acb0dca960e29be173ae6f1a93e33ca51b4de81ed3a5561ef495e1f479abfd73017c7fd207ca888478bfffa66e13771a6a9e692af6ac7a3b6c6f4eb37f44
SSDEEP 196608:S60CKZ5v+xc68AwSRpbCi3CUMEMkhRvTO:lGEc64SRpbCK1MMfa
TLSH
T10596D0217E82C031D6520271596CBBFB45BDAA212B3481D7B79C162D8F305D26F37BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 30 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4872	netsh.exe
2484	netsh.exe
4864	netsh.exe
4968	netsh.exe
4868	netsh.exe
1276	netsh.exe
1036	netsh.exe
564	netsh.exe
2316	netsh.exe
4604	netsh.exe
4556	netsh.exe
3736	netsh.exe
5668	netsh.exe
5528	netsh.exe
6896	netsh.exe
2832	netsh.exe
1420	netsh.exe
6476	netsh.exe
780	netsh.exe
2796	netsh.exe
6596	netsh.exe
2476	netsh.exe
1308	netsh.exe
2676	netsh.exe
992	netsh.exe
4952	netsh.exe
4928	netsh.exe
1948	netsh.exe
3992	netsh.exe
860	netsh.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wire\wire.exe	Wirevpn.exe
File created	C:\Windows\SysWOW64\wire\upWire.exe	Wirevpn.exe
File created	C:\Windows\SysWOW64\wire\wire.dll	Wirevpn.exe
File created	C:\Windows\SysWOW64\wire\log\upWire.exe20260702-014407.4172.log	upWire.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wireCon.ini	upWire.exe

Executes dropped EXE 3 IoCs

pid	Process
4172	upWire.exe
1608	upWire.exe
3684	wire.exe

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4340	sc.exe
3052	sc.exe
7164	sc.exe
2568	sc.exe
4120	sc.exe
6452	sc.exe
6528	sc.exe
2488	sc.exe
4144	sc.exe
1556	sc.exe
2144	sc.exe
1824	sc.exe
2728	sc.exe
1440	sc.exe
6204	sc.exe
2868	sc.exe
7100	sc.exe
5984	sc.exe
996	sc.exe
6536	sc.exe
6840	sc.exe
3008	sc.exe
3972	sc.exe
720	sc.exe

Loads dropped DLL 1 IoCs

pid	Process
3684	wire.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upWire.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wirevpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wire.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upWire.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	wire.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5752	wmic.exe
5752	wmic.exe
5752	wmic.exe
5752	wmic.exe
2312	wmic.exe
2312	wmic.exe
2312	wmic.exe
2312	wmic.exe
7032	wmic.exe
7032	wmic.exe
7032	wmic.exe
7032	wmic.exe
5552	Wirevpn.exe
5552	Wirevpn.exe
4172	upWire.exe
4172	upWire.exe
1608	upWire.exe
1608	upWire.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5752	wmic.exe
Token: SeSecurityPrivilege	5752	wmic.exe
Token: SeTakeOwnershipPrivilege	5752	wmic.exe
Token: SeLoadDriverPrivilege	5752	wmic.exe
Token: SeSystemProfilePrivilege	5752	wmic.exe
Token: SeSystemtimePrivilege	5752	wmic.exe
Token: SeProfSingleProcessPrivilege	5752	wmic.exe
Token: SeIncBasePriorityPrivilege	5752	wmic.exe
Token: SeCreatePagefilePrivilege	5752	wmic.exe
Token: SeBackupPrivilege	5752	wmic.exe
Token: SeRestorePrivilege	5752	wmic.exe
Token: SeShutdownPrivilege	5752	wmic.exe
Token: SeDebugPrivilege	5752	wmic.exe
Token: SeSystemEnvironmentPrivilege	5752	wmic.exe
Token: SeRemoteShutdownPrivilege	5752	wmic.exe
Token: SeUndockPrivilege	5752	wmic.exe
Token: SeManageVolumePrivilege	5752	wmic.exe
Token: 33	5752	wmic.exe
Token: 34	5752	wmic.exe
Token: 35	5752	wmic.exe
Token: 36	5752	wmic.exe
Token: SeIncreaseQuotaPrivilege	5752	wmic.exe
Token: SeSecurityPrivilege	5752	wmic.exe
Token: SeTakeOwnershipPrivilege	5752	wmic.exe
Token: SeLoadDriverPrivilege	5752	wmic.exe
Token: SeSystemProfilePrivilege	5752	wmic.exe
Token: SeSystemtimePrivilege	5752	wmic.exe
Token: SeProfSingleProcessPrivilege	5752	wmic.exe
Token: SeIncBasePriorityPrivilege	5752	wmic.exe
Token: SeCreatePagefilePrivilege	5752	wmic.exe
Token: SeBackupPrivilege	5752	wmic.exe
Token: SeRestorePrivilege	5752	wmic.exe
Token: SeShutdownPrivilege	5752	wmic.exe
Token: SeDebugPrivilege	5752	wmic.exe
Token: SeSystemEnvironmentPrivilege	5752	wmic.exe
Token: SeRemoteShutdownPrivilege	5752	wmic.exe
Token: SeUndockPrivilege	5752	wmic.exe
Token: SeManageVolumePrivilege	5752	wmic.exe
Token: 33	5752	wmic.exe
Token: 34	5752	wmic.exe
Token: 35	5752	wmic.exe
Token: 36	5752	wmic.exe
Token: SeIncreaseQuotaPrivilege	2312	wmic.exe
Token: SeSecurityPrivilege	2312	wmic.exe
Token: SeTakeOwnershipPrivilege	2312	wmic.exe
Token: SeLoadDriverPrivilege	2312	wmic.exe
Token: SeSystemProfilePrivilege	2312	wmic.exe
Token: SeSystemtimePrivilege	2312	wmic.exe
Token: SeProfSingleProcessPrivilege	2312	wmic.exe
Token: SeIncBasePriorityPrivilege	2312	wmic.exe
Token: SeCreatePagefilePrivilege	2312	wmic.exe
Token: SeBackupPrivilege	2312	wmic.exe
Token: SeRestorePrivilege	2312	wmic.exe
Token: SeShutdownPrivilege	2312	wmic.exe
Token: SeDebugPrivilege	2312	wmic.exe
Token: SeSystemEnvironmentPrivilege	2312	wmic.exe
Token: SeRemoteShutdownPrivilege	2312	wmic.exe
Token: SeUndockPrivilege	2312	wmic.exe
Token: SeManageVolumePrivilege	2312	wmic.exe
Token: 33	2312	wmic.exe
Token: 34	2312	wmic.exe
Token: 35	2312	wmic.exe
Token: 36	2312	wmic.exe
Token: SeIncreaseQuotaPrivilege	2312	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5552	Wirevpn.exe
5552	Wirevpn.exe
5552	Wirevpn.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5552	Wirevpn.exe
5552	Wirevpn.exe
5552	Wirevpn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 5752	5552	Wirevpn.exe	89
PID 5552 wrote to memory of 2312	5552	Wirevpn.exe	92
PID 5552 wrote to memory of 7032	5552	Wirevpn.exe	94
PID 5552 wrote to memory of 564	5552	Wirevpn.exe	96
PID 5552 wrote to memory of 7040	5552	Wirevpn.exe	98
PID 5552 wrote to memory of 860	5552	Wirevpn.exe	100
PID 7040 wrote to memory of 6204	7040	cmd.exe	102
PID 5552 wrote to memory of 3160	5552	Wirevpn.exe	103
PID 5552 wrote to memory of 4604	5552	Wirevpn.exe	105
PID 3160 wrote to memory of 6528	3160	cmd.exe	107
PID 5552 wrote to memory of 5176	5552	Wirevpn.exe	109
PID 5176 wrote to memory of 2868	5176	cmd.exe	111
PID 5552 wrote to memory of 3448	5552	Wirevpn.exe	113
PID 4172 wrote to memory of 4260	4172	upWire.exe	115
PID 4260 wrote to memory of 1308	4260	cmd.exe	116
PID 5552 wrote to memory of 4952	5552	Wirevpn.exe	117
PID 3448 wrote to memory of 6536	3448	cmd.exe	119
PID 1608 wrote to memory of 4460	1608	upWire.exe	121
PID 4460 wrote to memory of 4556	4460	cmd.exe	123
PID 5552 wrote to memory of 3056	5552	Wirevpn.exe	124
PID 4172 wrote to memory of 4736	4172	upWire.exe	126
PID 4736 wrote to memory of 2832	4736	cmd.exe	127
PID 5552 wrote to memory of 1420	5552	Wirevpn.exe	128
PID 3056 wrote to memory of 2488	3056	cmd.exe	129
PID 1608 wrote to memory of 2404	1608	upWire.exe	131
PID 5552 wrote to memory of 2924	5552	Wirevpn.exe	133
PID 2404 wrote to memory of 2316	2404	cmd.exe	135
PID 2924 wrote to memory of 4340	2924	cmd.exe	136
PID 4172 wrote to memory of 3964	4172	upWire.exe	137
PID 3964 wrote to memory of 2796	3964	cmd.exe	138
PID 5552 wrote to memory of 6596	5552	Wirevpn.exe	139
PID 5552 wrote to memory of 3424	5552	Wirevpn.exe	141
PID 1608 wrote to memory of 5936	1608	upWire.exe	143
PID 3424 wrote to memory of 4144	3424	cmd.exe	145
PID 4172 wrote to memory of 844	4172	upWire.exe	146
PID 5936 wrote to memory of 4928	5936	cmd.exe	147
PID 844 wrote to memory of 3736	844	cmd.exe	148
PID 5552 wrote to memory of 4256	5552	Wirevpn.exe	149
PID 4256 wrote to memory of 6840	4256	cmd.exe	151
PID 4172 wrote to memory of 3592	4172	upWire.exe	152
PID 1608 wrote to memory of 3876	1608	upWire.exe	153
PID 3592 wrote to memory of 4868	3592	cmd.exe	155
PID 5552 wrote to memory of 4872	5552	Wirevpn.exe	156
PID 5552 wrote to memory of 4156	5552	Wirevpn.exe	158
PID 3876 wrote to memory of 2484	3876	cmd.exe	159
PID 4156 wrote to memory of 1556	4156	cmd.exe	161
PID 5552 wrote to memory of 4864	5552	Wirevpn.exe	162
PID 5552 wrote to memory of 584	5552	Wirevpn.exe	164
PID 1608 wrote to memory of 1600	1608	upWire.exe	165
PID 4172 wrote to memory of 7000	4172	upWire.exe	168
PID 584 wrote to memory of 3008	584	cmd.exe	169
PID 1600 wrote to memory of 4968	1600	cmd.exe	170
PID 7000 wrote to memory of 5668	7000	cmd.exe	171
PID 5552 wrote to memory of 5840	5552	Wirevpn.exe	172
PID 1608 wrote to memory of 3412	1608	upWire.exe	174
PID 5552 wrote to memory of 2476	5552	Wirevpn.exe	176
PID 5840 wrote to memory of 3052	5840	cmd.exe	178
PID 3412 wrote to memory of 1276	3412	cmd.exe	179
PID 5552 wrote to memory of 2848	5552	Wirevpn.exe	180
PID 5552 wrote to memory of 1948	5552	Wirevpn.exe	182
PID 5552 wrote to memory of 780	5552	Wirevpn.exe	183
PID 5552 wrote to memory of 6476	5552	Wirevpn.exe	184
PID 5552 wrote to memory of 2676	5552	Wirevpn.exe	185
PID 5552 wrote to memory of 1036	5552	Wirevpn.exe	186

C:\Users\Admin\AppData\Local\Temp\Wirevpn.exe
"C:\Users\Admin\AppData\Local\Temp\Wirevpn.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic diskdrive where index=0 get serialnumber
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5752
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get Product
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7032
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wirevpnpc_Wirevpn"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar_wfp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7040
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6204
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_Wirevpn" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Wirevpn.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar2_wfp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar2_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6528
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_Wirevpn" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\Wirevpn.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop miobles_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\SysWOW64\sc.exe
    sc stop miobles_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop wvpack_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SysWOW64\sc.exe
    sc stop wvpack_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6536
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wirevpnpc_wrvPlay"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop ylwfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\sc.exe
    sc stop ylwfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2488
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_wrvPlay" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\wrvPlay.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop XunYouFilter
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc stop XunYouFilter
    3⤵
    - Launches sc.exe
    PID:4340
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_wrvPlay" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\wrvPlay.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:6596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop netwfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\sc.exe
    sc stop netwfp
    3⤵
    - Launches sc.exe
    PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop ProxyDrvA0
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\sc.exe
    sc stop ProxyDrvA0
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6840
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wirevpnpc_wrvSavi"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop uupacket
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SysWOW64\sc.exe
    sc stop uupacket
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1556
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_wrvSavi" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\wrvSavi.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop vkdpi
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\sc.exe
    sc stop vkdpi
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop uuwfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Windows\SysWOW64\sc.exe
    sc stop uuwfp
    3⤵
    - Launches sc.exe
    PID:3052
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_wrvSavi" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\wrvSavi.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop netfilter2
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2848
- - C:\Windows\SysWOW64\sc.exe
    sc stop netfilter2
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7164
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wire"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1948
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:780
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6476
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="upWire"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2676
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1036
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3992
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wirevpnpc_crashreport"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop xfilter
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\sc.exe
    sc stop xfilter
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop ylpcaket
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5772
- - C:\Windows\SysWOW64\sc.exe
    sc stop ylpcaket
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop forager_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5736
- - C:\Windows\SysWOW64\sc.exe
    sc stop forager_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5984
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_crashreport" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\crashreport.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitark_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:440
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitark_wfp
    3⤵
    - Launches sc.exe
    PID:3972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitarp_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6640
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitarp_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitart_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6364
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitart_wfp
    3⤵
    - Launches sc.exe
    PID:2568
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_crashreport" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\crashreport.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar2k_wfp
  2⤵
  PID:636
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar2k_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar2p_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar2p_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar2t_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5364
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar2t_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop mioblesk_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6348
- - C:\Windows\SysWOW64\sc.exe
    sc stop mioblesk_wfp
    3⤵
    - Launches sc.exe
    PID:720
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop mioblesp_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6660
- - C:\Windows\SysWOW64\sc.exe
    sc stop mioblesp_wfp
    3⤵
    - Launches sc.exe
    PID:1440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop mioblest_wfp
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\sc.exe
    sc stop mioblest_wfp
    3⤵
    - Launches sc.exe
    PID:6452

C:\Windows\SysWOW64\wire\upWire.exe
C:\Windows\SysWOW64\wire\upWire.exe
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="upWire"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="upWire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="wire"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="wire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:7000
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5668

C:\Windows\SysWOW64\wire\upWire.exe
C:\Windows\SysWOW64\wire\upWire.exe
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="upWire"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="upWire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="wire"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="wire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1276

C:\Windows\SysWOW64\wire\wire.exe
C:\Windows\SysWOW64\wire\wire.exe -s wire -m 47927531f28f0ea444c0a803ac72e282
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3684
- C:\Windows\SysWOW64\cmd.exe
  cmd ver
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

upWire.exe

Path C:\Windows\SysWOW64\wire\upWire.exe
Size 2.3MB
SHA256 90b89a6dc4565c9817e7db8323702006860cb2b49f352863f2b18ba21c66b435
MD5 8f6cec6f5436eb0fe79a1f26a1c663d4
SHA1 4fb4b6ab3aa38fd54b8f52854e0d4b2a052a2805
SHA512 a50b117bc3c041efc1783fd4df786d229b70ec686bd0e575238a5f92ddef333776eb55bfe7462e674430a8f79f7f9885e8e397136951354e9b79a75a07facd90
SSDEEP 49152:DsQqp8Ay5PMpaOjPufBp3cyKB33Ma67NreT6scPEWcylvJbp:lquA8PQaOjPuZp3cyKB33Mx7NrpstQ
TLSH
T122B5AE12BA42C072E59202B462FA6B7FCC3A9934573585C397D01E7589312E37B3E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wire.dll

Path C:\Windows\SysWOW64\wire\wire.dll
Size 5.4MB
SHA256 0179ad14c9df5141b4479688d0135aa2132e1605dbd7852a2fac7ed543e53138
MD5 d06c8c28654ec6fba03f8ee1f76b8641
SHA1 69a15ed67caf436c8854b40f94a5a89b1d6117ff
SHA512 72bba1303d1c3ff9414d2946dc271e261d89018d01361cac7df11a9d45eb48468b4a2104b45c9e2843283a6649f2429e7bef4068d5f6150b07756e5938dda4f5
SSDEEP 98304:Nnw4WxjRgzZRoozrTL6aOyJLcOB+c5TUHe0qQ3r:hw5vg/OwcVr
TLSH
T111463A40F9DB54B6EA03163044A7A2BF27347D054B25DBC7EA10BF7AE8776D11E32298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wire.exe

Path C:\Windows\SysWOW64\wire\wire.exe
Size 343KB
SHA256 6729c71328ce8498c26e6a46b7ba2fe84c611814d92703bdc2c1ebb7339d43fd
MD5 3d96f407857914c19b2cc48c9d54238e
SHA1 b3df3fc61edf024546954659a68042d7bb2dff33
SHA512 1a92713182a8165ef84c02801fc12ebcedf9917ea712b4a1467d788d6219ff50a811ba6fb0b05ca14bd08ed66401d6e916b1629b4d6e3ea44fabe0627ae37859
SSDEEP 6144:tZMJkE3mH7mubOw4uT795LnMNto67whLgLeEN7ShMks5JgMuFxTOrYqAOY4BuJLZ:tZMy/H7mubf4uTX+N7whAeQPuFxTOrYH
TLSH
T15874B0127AC1E032D9B101705FA9DB25967EAC300F6159EBA3D47A2E9F306D1DA31F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3684-16-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/3684-18-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/3684-20-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/3684-27-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/3684-29-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/3684-30-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/3684-32-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download