68bad2fda125ec4c4e7c029f62756f83d6f58309ba484cfb151b6b3eea0f18f6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wirevpn.exe
Size 8.2MB
Sample260702-a17cpsaw4v
SHA256 68bad2fda125ec4c4e7c029f62756f83d6f58309ba484cfb151b6b3eea0f18f6
MD5 6458265f48b9fb7f02ab3d0bfd335562
SHA1 05c25a81f4b6032445d0e4e0e09b0ea14cad722d
SHA512 6860acb0dca960e29be173ae6f1a93e33ca51b4de81ed3a5561ef495e1f479abfd73017c7fd207ca888478bfffa66e13771a6a9e692af6ac7a3b6c6f4eb37f44
SSDEEP 196608:S60CKZ5v+xc68AwSRpbCi3CUMEMkhRvTO:lGEc64SRpbCK1MMfa
TLSH
T10596D0217E82C031D6520271596CBBFB45BDAA212B3481D7B79C162D8F305D26F37BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 30 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4980	netsh.exe
2648	netsh.exe
5096	netsh.exe
5068	netsh.exe
1824	netsh.exe
2056	netsh.exe
2568	netsh.exe
528	netsh.exe
3988	netsh.exe
1664	netsh.exe
4644	netsh.exe
4912	netsh.exe
4328	netsh.exe
4528	netsh.exe
3112	netsh.exe
2688	netsh.exe
560	netsh.exe
4592	netsh.exe
3320	netsh.exe
2212	netsh.exe
4484	netsh.exe
2152	netsh.exe
2908	netsh.exe
3628	netsh.exe
2432	netsh.exe
3112	netsh.exe
2812	netsh.exe
1536	netsh.exe
3532	netsh.exe
4504	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Wirevpn.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wire\wire.exe	Wirevpn.exe
File created	C:\Windows\SysWOW64\wire\upWire.exe	Wirevpn.exe
File created	C:\Windows\SysWOW64\wire\wire.dll	Wirevpn.exe
File created	C:\Windows\SysWOW64\wire\log\upWire.exe20260702-014406.4992.log	upWire.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wireCon.ini	upWire.exe

Executes dropped EXE 3 IoCs

pid	Process
4992	upWire.exe
2916	upWire.exe
1460	wire.exe

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2636	sc.exe
2516	sc.exe
208	sc.exe
2260	sc.exe
1776	sc.exe
4148	sc.exe
668	sc.exe
3956	sc.exe
1948	sc.exe
1132	sc.exe
1612	sc.exe
3536	sc.exe
4796	sc.exe
820	sc.exe
2276	sc.exe
1156	sc.exe
3620	sc.exe
4784	sc.exe
5100	sc.exe
4092	sc.exe
3552	sc.exe
1436	sc.exe
4556	sc.exe
4288	sc.exe

Loads dropped DLL 1 IoCs

pid	Process
1460	wire.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upWire.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upWire.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wire.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	wire.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	wire.exe

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc	stream
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4252	Wirevpn.exe
4252	Wirevpn.exe
2916	upWire.exe
2916	upWire.exe
4992	upWire.exe
4992	upWire.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4592	wmic.exe
Token: SeSecurityPrivilege	4592	wmic.exe
Token: SeTakeOwnershipPrivilege	4592	wmic.exe
Token: SeLoadDriverPrivilege	4592	wmic.exe
Token: SeSystemProfilePrivilege	4592	wmic.exe
Token: SeSystemtimePrivilege	4592	wmic.exe
Token: SeProfSingleProcessPrivilege	4592	wmic.exe
Token: SeIncBasePriorityPrivilege	4592	wmic.exe
Token: SeCreatePagefilePrivilege	4592	wmic.exe
Token: SeBackupPrivilege	4592	wmic.exe
Token: SeRestorePrivilege	4592	wmic.exe
Token: SeShutdownPrivilege	4592	wmic.exe
Token: SeDebugPrivilege	4592	wmic.exe
Token: SeSystemEnvironmentPrivilege	4592	wmic.exe
Token: SeRemoteShutdownPrivilege	4592	wmic.exe
Token: SeUndockPrivilege	4592	wmic.exe
Token: SeManageVolumePrivilege	4592	wmic.exe
Token: 33	4592	wmic.exe
Token: 34	4592	wmic.exe
Token: 35	4592	wmic.exe
Token: 36	4592	wmic.exe
Token: SeIncreaseQuotaPrivilege	4592	wmic.exe
Token: SeSecurityPrivilege	4592	wmic.exe
Token: SeTakeOwnershipPrivilege	4592	wmic.exe
Token: SeLoadDriverPrivilege	4592	wmic.exe
Token: SeSystemProfilePrivilege	4592	wmic.exe
Token: SeSystemtimePrivilege	4592	wmic.exe
Token: SeProfSingleProcessPrivilege	4592	wmic.exe
Token: SeIncBasePriorityPrivilege	4592	wmic.exe
Token: SeCreatePagefilePrivilege	4592	wmic.exe
Token: SeBackupPrivilege	4592	wmic.exe
Token: SeRestorePrivilege	4592	wmic.exe
Token: SeShutdownPrivilege	4592	wmic.exe
Token: SeDebugPrivilege	4592	wmic.exe
Token: SeSystemEnvironmentPrivilege	4592	wmic.exe
Token: SeRemoteShutdownPrivilege	4592	wmic.exe
Token: SeUndockPrivilege	4592	wmic.exe
Token: SeManageVolumePrivilege	4592	wmic.exe
Token: 33	4592	wmic.exe
Token: 34	4592	wmic.exe
Token: 35	4592	wmic.exe
Token: 36	4592	wmic.exe
Token: SeIncreaseQuotaPrivilege	2164	wmic.exe
Token: SeSecurityPrivilege	2164	wmic.exe
Token: SeTakeOwnershipPrivilege	2164	wmic.exe
Token: SeLoadDriverPrivilege	2164	wmic.exe
Token: SeSystemProfilePrivilege	2164	wmic.exe
Token: SeSystemtimePrivilege	2164	wmic.exe
Token: SeProfSingleProcessPrivilege	2164	wmic.exe
Token: SeIncBasePriorityPrivilege	2164	wmic.exe
Token: SeCreatePagefilePrivilege	2164	wmic.exe
Token: SeBackupPrivilege	2164	wmic.exe
Token: SeRestorePrivilege	2164	wmic.exe
Token: SeShutdownPrivilege	2164	wmic.exe
Token: SeDebugPrivilege	2164	wmic.exe
Token: SeSystemEnvironmentPrivilege	2164	wmic.exe
Token: SeRemoteShutdownPrivilege	2164	wmic.exe
Token: SeUndockPrivilege	2164	wmic.exe
Token: SeManageVolumePrivilege	2164	wmic.exe
Token: 33	2164	wmic.exe
Token: 34	2164	wmic.exe
Token: 35	2164	wmic.exe
Token: 36	2164	wmic.exe
Token: SeIncreaseQuotaPrivilege	2164	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4252	Wirevpn.exe
4252	Wirevpn.exe
4252	Wirevpn.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4252	Wirevpn.exe
4252	Wirevpn.exe
4252	Wirevpn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4592	4252	Wirevpn.exe	85
PID 4252 wrote to memory of 2164	4252	Wirevpn.exe	88
PID 4252 wrote to memory of 3720	4252	Wirevpn.exe	90
PID 4252 wrote to memory of 4328	4252	Wirevpn.exe	92
PID 4252 wrote to memory of 4980	4252	Wirevpn.exe	94
PID 4252 wrote to memory of 4228	4252	Wirevpn.exe	97
PID 4228 wrote to memory of 2636	4228	cmd.exe	156
PID 4992 wrote to memory of 2988	4992	upWire.exe	101
PID 2988 wrote to memory of 3112	2988	cmd.exe	167
PID 4252 wrote to memory of 3100	4252	Wirevpn.exe	103
PID 4252 wrote to memory of 1824	4252	Wirevpn.exe	105
PID 2916 wrote to memory of 204	2916	upWire.exe	108
PID 204 wrote to memory of 2056	204	cmd.exe	110
PID 3100 wrote to memory of 2516	3100	cmd.exe	111
PID 4252 wrote to memory of 4772	4252	Wirevpn.exe	112
PID 2916 wrote to memory of 3204	2916	upWire.exe	114
PID 4252 wrote to memory of 2812	4252	Wirevpn.exe	116
PID 4992 wrote to memory of 3964	4992	upWire.exe	118
PID 4772 wrote to memory of 3620	4772	cmd.exe	119
PID 3204 wrote to memory of 3320	3204	cmd.exe	121
PID 3964 wrote to memory of 2212	3964	cmd.exe	227
PID 4252 wrote to memory of 4792	4252	Wirevpn.exe	122
PID 2916 wrote to memory of 1052	2916	upWire.exe	124
PID 4252 wrote to memory of 4484	4252	Wirevpn.exe	126
PID 4792 wrote to memory of 1948	4792	cmd.exe	128
PID 1052 wrote to memory of 1536	1052	cmd.exe	129
PID 4252 wrote to memory of 1964	4252	Wirevpn.exe	130
PID 4992 wrote to memory of 3784	4992	upWire.exe	132
PID 1964 wrote to memory of 4784	1964	cmd.exe	133
PID 2916 wrote to memory of 4968	2916	upWire.exe	134
PID 3784 wrote to memory of 560	3784	cmd.exe	136
PID 4252 wrote to memory of 5008	4252	Wirevpn.exe	137
PID 4968 wrote to memory of 2152	4968	cmd.exe	139
PID 4252 wrote to memory of 2568	4252	Wirevpn.exe	140
PID 5008 wrote to memory of 5100	5008	cmd.exe	142
PID 4252 wrote to memory of 2616	4252	Wirevpn.exe	143
PID 2916 wrote to memory of 3328	2916	upWire.exe	145
PID 2616 wrote to memory of 1132	2616	cmd.exe	147
PID 4992 wrote to memory of 4068	4992	upWire.exe	148
PID 4252 wrote to memory of 4232	4252	Wirevpn.exe	149
PID 4068 wrote to memory of 2648	4068	cmd.exe	150
PID 3328 wrote to memory of 4528	3328	cmd.exe	196
PID 4232 wrote to memory of 1612	4232	cmd.exe	153
PID 4252 wrote to memory of 4988	4252	Wirevpn.exe	154
PID 2916 wrote to memory of 3356	2916	upWire.exe	155
PID 4992 wrote to memory of 2636	4992	upWire.exe	156
PID 2636 wrote to memory of 5096	2636	cmd.exe	159
PID 4988 wrote to memory of 3536	4988	cmd.exe	160
PID 3356 wrote to memory of 1664	3356	cmd.exe	161
PID 4252 wrote to memory of 4128	4252	Wirevpn.exe	162
PID 4992 wrote to memory of 2632	4992	upWire.exe	164
PID 4252 wrote to memory of 4504	4252	Wirevpn.exe	165
PID 4252 wrote to memory of 3988	4252	Wirevpn.exe	166
PID 4252 wrote to memory of 3112	4252	Wirevpn.exe	167
PID 4252 wrote to memory of 4644	4252	Wirevpn.exe	168
PID 4128 wrote to memory of 208	4128	cmd.exe	169
PID 4252 wrote to memory of 2908	4252	Wirevpn.exe	170
PID 4252 wrote to memory of 3532	4252	Wirevpn.exe	171
PID 2632 wrote to memory of 2688	2632	cmd.exe	178
PID 4252 wrote to memory of 5068	4252	Wirevpn.exe	179
PID 4252 wrote to memory of 5112	4252	Wirevpn.exe	181
PID 5112 wrote to memory of 2260	5112	cmd.exe	184
PID 4252 wrote to memory of 4912	4252	Wirevpn.exe	185
PID 4252 wrote to memory of 3152	4252	Wirevpn.exe	187

C:\Users\Admin\AppData\Local\Temp\Wirevpn.exe
"C:\Users\Admin\AppData\Local\Temp\Wirevpn.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic diskdrive where index=0 get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get Product
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3720
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wirevpnpc_Wirevpn"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4328
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_Wirevpn" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Wirevpn.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar_wfp
    3⤵
    - Launches sc.exe
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar2_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar2_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2516
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_Wirevpn" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\Wirevpn.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop miobles_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\sc.exe
    sc stop miobles_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3620
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wirevpnpc_wrvPlay"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop wvpack_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\sc.exe
    sc stop wvpack_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1948
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_wrvPlay" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\wrvPlay.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop ylwfp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\sc.exe
    sc stop ylwfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop XunYouFilter
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\sc.exe
    sc stop XunYouFilter
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5100
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_wrvPlay" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\wrvPlay.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop netwfp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\sc.exe
    sc stop netwfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop ProxyDrvA0
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\SysWOW64\sc.exe
    sc stop ProxyDrvA0
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop uupacket
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\sc.exe
    sc stop uupacket
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop vkdpi
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\sc.exe
    sc stop vkdpi
    3⤵
    - Launches sc.exe
    PID:208
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wire"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4504
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3988
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3112
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="upWire"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4644
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3532
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wirevpnpc_wrvSavi"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5068
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop uuwfp
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\sc.exe
    sc stop uuwfp
    3⤵
    - Launches sc.exe
    PID:2260
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_wrvSavi" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\wrvSavi.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop netfilter2
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\sc.exe
    sc stop netfilter2
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop xfilter
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2468
- - C:\Windows\SysWOW64\sc.exe
    sc stop xfilter
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop ylpcaket
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\sc.exe
    sc stop ylpcaket
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop forager_wfp
  2⤵
  PID:4528
- - C:\Windows\SysWOW64\sc.exe
    sc stop forager_wfp
    3⤵
    - Launches sc.exe
    PID:668
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_wrvSavi" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\wrvSavi.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitark_wfp
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitark_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitarp_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3164
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitarp_wfp
    3⤵
    - Launches sc.exe
    PID:3956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitart_wfp
  2⤵
  PID:3264
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitart_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4556
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall delete rule name="wirevpnpc_crashreport"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar2k_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2904
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar2k_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar2p_wfp
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar2p_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4288
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_crashreport" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\crashreport.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop savitar2t_wfp
  2⤵
  PID:3812
- - C:\Windows\SysWOW64\sc.exe
    sc stop savitar2t_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop mioblesk_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc stop mioblesk_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop mioblesp_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:656
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\sc.exe
    sc stop mioblesp_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3552
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="wirevpnpc_crashreport" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\crashreport.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop mioblest_wfp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1616
- - C:\Windows\SysWOW64\sc.exe
    sc stop mioblest_wfp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1436

C:\Windows\SysWOW64\wire\upWire.exe
C:\Windows\SysWOW64\wire\upWire.exe
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="upWire"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="upWire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="wire"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="wire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2688

C:\Windows\SysWOW64\wire\upWire.exe
C:\Windows\SysWOW64\wire\upWire.exe
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="upWire"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="upWire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="wire"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="wire"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1664

C:\Windows\SysWOW64\wire\wire.exe
C:\Windows\SysWOW64\wire\wire.exe -s wire -m 7eb9a112e1263cda7295984f1a0dca86
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1460
- C:\Windows\SysWOW64\cmd.exe
  cmd ver
  2⤵
  - System Location Discovery: System Language Discovery
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

upWire.exe

Path C:\Windows\SysWOW64\wire\upWire.exe
Size 2.3MB
SHA256 90b89a6dc4565c9817e7db8323702006860cb2b49f352863f2b18ba21c66b435
MD5 8f6cec6f5436eb0fe79a1f26a1c663d4
SHA1 4fb4b6ab3aa38fd54b8f52854e0d4b2a052a2805
SHA512 a50b117bc3c041efc1783fd4df786d229b70ec686bd0e575238a5f92ddef333776eb55bfe7462e674430a8f79f7f9885e8e397136951354e9b79a75a07facd90
SSDEEP 49152:DsQqp8Ay5PMpaOjPufBp3cyKB33Ma67NreT6scPEWcylvJbp:lquA8PQaOjPuZp3cyKB33Mx7NrpstQ
TLSH
T122B5AE12BA42C072E59202B462FA6B7FCC3A9934573585C397D01E7589312E37B3E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wire.dll

Path C:\Windows\SysWOW64\wire\wire.dll
Size 5.4MB
SHA256 0179ad14c9df5141b4479688d0135aa2132e1605dbd7852a2fac7ed543e53138
MD5 d06c8c28654ec6fba03f8ee1f76b8641
SHA1 69a15ed67caf436c8854b40f94a5a89b1d6117ff
SHA512 72bba1303d1c3ff9414d2946dc271e261d89018d01361cac7df11a9d45eb48468b4a2104b45c9e2843283a6649f2429e7bef4068d5f6150b07756e5938dda4f5
SSDEEP 98304:Nnw4WxjRgzZRoozrTL6aOyJLcOB+c5TUHe0qQ3r:hw5vg/OwcVr
TLSH
T111463A40F9DB54B6EA03163044A7A2BF27347D054B25DBC7EA10BF7AE8776D11E32298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wire.exe

Path C:\Windows\SysWOW64\wire\wire.exe
Size 343KB
SHA256 6729c71328ce8498c26e6a46b7ba2fe84c611814d92703bdc2c1ebb7339d43fd
MD5 3d96f407857914c19b2cc48c9d54238e
SHA1 b3df3fc61edf024546954659a68042d7bb2dff33
SHA512 1a92713182a8165ef84c02801fc12ebcedf9917ea712b4a1467d788d6219ff50a811ba6fb0b05ca14bd08ed66401d6e916b1629b4d6e3ea44fabe0627ae37859
SSDEEP 6144:tZMJkE3mH7mubOw4uT795LnMNto67whLgLeEN7ShMks5JgMuFxTOrYqAOY4BuJLZ:tZMy/H7mubf4uTX+N7whAeQPuFxTOrYH
TLSH
T15874B0127AC1E032D9B101705FA9DB25967EAC300F6159EBA3D47A2E9F306D1DA31F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1460-26-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/1460-30-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/1460-35-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/1460-37-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/1460-39-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/1460-40-0x000000006CF00000-0x000000006D43E000-memory.dmp

Download

memory/4252-1-0x0000000004460000-0x0000000004470000-memory.dmp

Download

memory/4252-21-0x0000000004460000-0x0000000004470000-memory.dmp

Download