932bcf6c68e34fb99ffafb5ae62a1473fe761d961034cb5630dc3a9ba9155ccb

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RDPW_Installer.exe
Size 2.4MB
Sample260729-pptpssvanf
SHA256 932bcf6c68e34fb99ffafb5ae62a1473fe761d961034cb5630dc3a9ba9155ccb
MD5 6ebea4d46302623d47827cd82e0aa4b3
SHA1 51c8d2af8a8f00da1eab9ce34a9f9505115295de
SHA512 5c37af879652aee3f18be92732c0bf52ac8b7e6aaded5a7f31303e5f0eef0fea75a4a779a436dbb06960af390bcc5722cac3fa7db3cd283fa80ce499af94700d
SSDEEP 49152:7QT501gtKhLiL4uvT4pHmaBfxoxokdwsCIG0nUCqIOQvVLJg5Hugq:7fZ8aHNBfLRIRUwOQtLJ1gq
TLSH
T178C52302AED0EE79D38139704099E635696D2C38CF2F78F7ABDE3E57B4343585825294
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2772	netsh.exe
5400	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWInst.exe

Executes dropped EXE 21 IoCs

pid	Process
5232	RDPWInst.exe
4860	RDPWInst.exe
2308	LGPO.exe
1112	RDP_CnC.exe
2460	RDPWInst.exe
4364	RDP_CnC.exe
4264	RDP_CnC.exe
4764	RDP_CnC.exe
3848	RDP_CnC.exe
3352	RDP_CnC.exe
2716	RDP_CnC.exe
1708	RDP_CnC.exe
1504	RDP_CnC.exe
2176	RDP_CnC.exe
4248	RDP_CnC.exe
5400	RDP_CnC.exe
5972	RDP_CnC.exe
6084	RDP_CnC.exe
1900	RDP_CnC.exe
3284	RDP_CnC.exe
2480	RDP_CnC.exe

Loads dropped DLL 18 IoCs

pid	Process
2100	svchost.exe
2412	svchost.exe
440	svchost.exe
5188	svchost.exe
5636	svchost.exe
468	svchost.exe
4248	svchost.exe
1564	svchost.exe
5944	svchost.exe
5304	svchost.exe
1284	svchost.exe
3080	svchost.exe
1000	svchost.exe
4628	svchost.exe
4252	svchost.exe
6016	svchost.exe
5924	svchost.exe
2864	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWInst.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	LGPO.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	LGPO.exe
File created	C:\Windows\System32\GroupPolicy\User\Registry.pol	LGPO.exe
File created	C:\Windows\System32\rfxvmt.dll	RDPWInst.exe
File opened for modification	C:\Windows\system32\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_332724ed-3c1a-4b0f-bd9b-045e18507ba6	svchost.exe
File opened for modification	C:\Windows\System32\GroupPolicy	LGPO.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	LGPO.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\RDP Wrapper	xcopy.exe
File created	C:\Program Files\RDP Wrapper\update.bat	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\RDP_CnC.exe	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\3BF7.tmp	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\3BF7.tmp	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\update.bat	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\3BF7.tmp	xcopy.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWInst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWInst.exe
File opened for modification	C:\Program Files\RDP Wrapper	xcopy.exe
File created	C:\Program Files\RDP Wrapper\RDP_CnC.exe	xcopy.exe
File created	C:\Program Files\RDP Wrapper\RDPWInst.exe	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\RDPWInst.exe	xcopy.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
464	cmd.exe
812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LGPO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPW_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4700	PING.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4700	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
440	svchost.exe
440	svchost.exe
440	svchost.exe
440	svchost.exe
5188	svchost.exe
5188	svchost.exe
5188	svchost.exe
5188	svchost.exe
5636	svchost.exe
5636	svchost.exe
5636	svchost.exe
5636	svchost.exe
468	svchost.exe
468	svchost.exe
468	svchost.exe
468	svchost.exe
4248	svchost.exe
4248	svchost.exe
4248	svchost.exe
4248	svchost.exe
1564	svchost.exe
1564	svchost.exe
1564	svchost.exe
1564	svchost.exe
5944	svchost.exe
5944	svchost.exe
5944	svchost.exe
5944	svchost.exe
5304	svchost.exe
5304	svchost.exe
5304	svchost.exe
5304	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
3080	svchost.exe
3080	svchost.exe
3080	svchost.exe
3080	svchost.exe
1000	svchost.exe
1000	svchost.exe
1000	svchost.exe
1000	svchost.exe
4628	svchost.exe
4628	svchost.exe
4628	svchost.exe
4628	svchost.exe
4252	svchost.exe
4252	svchost.exe
4252	svchost.exe
4252	svchost.exe
6016	svchost.exe
6016	svchost.exe
6016	svchost.exe
6016	svchost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	RDPWInst.exe
Token: SeAuditPrivilege	2100	svchost.exe
Token: SeAuditPrivilege	2100	svchost.exe
Token: SeAuditPrivilege	2100	svchost.exe
Token: SeAuditPrivilege	2100	svchost.exe
Token: SeTakeOwnershipPrivilege	4480	svchost.exe
Token: SeTakeOwnershipPrivilege	4480	svchost.exe
Token: SeTakeOwnershipPrivilege	4480	svchost.exe
Token: SeTcbPrivilege	4480	svchost.exe
Token: SeTcbPrivilege	4480	svchost.exe
Token: SeAuditPrivilege	2412	svchost.exe
Token: SeAuditPrivilege	440	svchost.exe
Token: SeAuditPrivilege	5188	svchost.exe
Token: SeAuditPrivilege	5636	svchost.exe
Token: SeAuditPrivilege	468	svchost.exe
Token: SeAuditPrivilege	4248	svchost.exe
Token: SeAuditPrivilege	1564	svchost.exe
Token: SeAuditPrivilege	5944	svchost.exe
Token: SeAuditPrivilege	5304	svchost.exe
Token: SeAuditPrivilege	1284	svchost.exe
Token: SeAuditPrivilege	3080	svchost.exe
Token: SeAuditPrivilege	1000	svchost.exe
Token: SeAuditPrivilege	4628	svchost.exe
Token: SeAuditPrivilege	4252	svchost.exe
Token: SeAuditPrivilege	6016	svchost.exe
Token: SeAuditPrivilege	5924	svchost.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1112	RDP_CnC.exe
4364	RDP_CnC.exe
4264	RDP_CnC.exe
4764	RDP_CnC.exe
3848	RDP_CnC.exe
3352	RDP_CnC.exe
2716	RDP_CnC.exe
1708	RDP_CnC.exe
1504	RDP_CnC.exe
2176	RDP_CnC.exe
4248	RDP_CnC.exe
5400	RDP_CnC.exe
5972	RDP_CnC.exe
6084	RDP_CnC.exe
1900	RDP_CnC.exe
3284	RDP_CnC.exe
2480	RDP_CnC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 464	4112	RDPW_Installer.exe	90
PID 464 wrote to memory of 5232	464	cmd.exe	91
PID 464 wrote to memory of 4700	464	cmd.exe	92
PID 464 wrote to memory of 6120	464	cmd.exe	93
PID 464 wrote to memory of 5572	464	cmd.exe	94
PID 464 wrote to memory of 2676	464	cmd.exe	95
PID 464 wrote to memory of 2096	464	cmd.exe	96
PID 464 wrote to memory of 4860	464	cmd.exe	97
PID 4860 wrote to memory of 2772	4860	RDPWInst.exe	102
PID 4860 wrote to memory of 5400	4860	RDPWInst.exe	108
PID 464 wrote to memory of 2308	464	cmd.exe	109
PID 464 wrote to memory of 4456	464	cmd.exe	110
PID 464 wrote to memory of 812	464	cmd.exe	111
PID 812 wrote to memory of 1112	812	cmd.exe	114
PID 1112 wrote to memory of 2528	1112	RDP_CnC.exe	117
PID 2528 wrote to memory of 5104	2528	net.exe	119
PID 1112 wrote to memory of 3340	1112	RDP_CnC.exe	120
PID 3340 wrote to memory of 2940	3340	net.exe	122
PID 1112 wrote to memory of 4364	1112	RDP_CnC.exe	126
PID 4364 wrote to memory of 3976	4364	RDP_CnC.exe	127
PID 3976 wrote to memory of 2428	3976	net.exe	129
PID 4364 wrote to memory of 836	4364	RDP_CnC.exe	130
PID 836 wrote to memory of 3460	836	net.exe	132
PID 4364 wrote to memory of 4264	4364	RDP_CnC.exe	136
PID 4264 wrote to memory of 2088	4264	RDP_CnC.exe	137
PID 2088 wrote to memory of 4544	2088	net.exe	139
PID 4264 wrote to memory of 568	4264	RDP_CnC.exe	140
PID 568 wrote to memory of 2964	568	net.exe	142
PID 4264 wrote to memory of 4764	4264	RDP_CnC.exe	146
PID 4764 wrote to memory of 1996	4764	RDP_CnC.exe	147
PID 1996 wrote to memory of 3992	1996	net.exe	149
PID 4764 wrote to memory of 4896	4764	RDP_CnC.exe	150
PID 4896 wrote to memory of 4996	4896	net.exe	152
PID 4764 wrote to memory of 3848	4764	RDP_CnC.exe	156
PID 3848 wrote to memory of 5056	3848	RDP_CnC.exe	157
PID 5056 wrote to memory of 4220	5056	net.exe	159
PID 3848 wrote to memory of 2908	3848	RDP_CnC.exe	160
PID 2908 wrote to memory of 2144	2908	net.exe	162
PID 3848 wrote to memory of 3352	3848	RDP_CnC.exe	166
PID 3352 wrote to memory of 244	3352	RDP_CnC.exe	167
PID 244 wrote to memory of 2176	244	net.exe	169
PID 3352 wrote to memory of 5960	3352	RDP_CnC.exe	170
PID 5960 wrote to memory of 4352	5960	net.exe	172
PID 3352 wrote to memory of 2716	3352	RDP_CnC.exe	176
PID 2716 wrote to memory of 2096	2716	RDP_CnC.exe	177
PID 2096 wrote to memory of 4544	2096	net.exe	179
PID 2716 wrote to memory of 2816	2716	RDP_CnC.exe	180
PID 2816 wrote to memory of 2164	2816	net.exe	182
PID 2716 wrote to memory of 1708	2716	RDP_CnC.exe	186
PID 1708 wrote to memory of 4320	1708	RDP_CnC.exe	187
PID 4320 wrote to memory of 3552	4320	net.exe	189
PID 1708 wrote to memory of 2020	1708	RDP_CnC.exe	190
PID 2020 wrote to memory of 4680	2020	net.exe	192
PID 1708 wrote to memory of 1504	1708	RDP_CnC.exe	196
PID 1504 wrote to memory of 2876	1504	RDP_CnC.exe	197
PID 2876 wrote to memory of 3400	2876	net.exe	199
PID 1504 wrote to memory of 3328	1504	RDP_CnC.exe	203
PID 3328 wrote to memory of 3372	3328	net.exe	205
PID 1504 wrote to memory of 2176	1504	RDP_CnC.exe	206
PID 2176 wrote to memory of 4908	2176	RDP_CnC.exe	207
PID 4908 wrote to memory of 4340	4908	net.exe	209
PID 2176 wrote to memory of 4664	2176	RDP_CnC.exe	210
PID 4664 wrote to memory of 4292	4664	net.exe	212
PID 2176 wrote to memory of 4248	2176	RDP_CnC.exe	216

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RDPW_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\RDPW_Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\3BF7.tmp\3BF8.bat C:\Users\Admin\AppData\Local\Temp\RDPW_Installer.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\RDPWInst.exe
    "RDPWInst" -u
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5232
- - C:\Windows\system32\PING.EXE
    ping -n 3 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4700
- - C:\Windows\system32\xcopy.exe
    xcopy "RDP_CnC.exe" "C:\Program Files\RDP Wrapper\" /s /I /y
    3⤵
    - Drops file in Program Files directory
    PID:6120
- - C:\Windows\system32\xcopy.exe
    xcopy "RDPWInst.exe" "C:\Program Files\RDP Wrapper\" /s /I /y
    3⤵
    - Drops file in Program Files directory
    PID:5572
- - C:\Windows\system32\xcopy.exe
    xcopy "update.bat" "C:\Program Files\RDP Wrapper\" /s /I /y
    3⤵
    - Drops file in Program Files directory
    PID:2676
- - C:\Windows\system32\xcopy.exe
    xcopy "RDP_CnC.lnk" "C:\Users\Admin\Desktop\" /s /I /y
    3⤵
    PID:2096
- - C:\Program Files\RDP Wrapper\RDPWInst.exe
    "C:\Program Files\RDP Wrapper\RDPWInst" -i -o
    3⤵
    - Server Software Component: Terminal Services DLL
    - Executes dropped EXE
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2772
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=udp localport=3389 profile=any action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\LGPO.exe
    lgpo /m H264_ON.pol
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2308
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /CREATE /SC ONSTART /DELAY 0002:00 /TN "RDPWUpdater" /TR "'C:\Program Files\RDP Wrapper\RDPWInst.exe' -w" /RL HIGHEST /RU SYSTEM /NP /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456
- - C:\Windows\system32\cmd.exe
    cmd.exe /C start "" "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Program Files\RDP Wrapper\RDP_CnC.exe
      "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1112
    - - C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2528
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        6⤵
        
        PID:5104
    - - C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3340
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        6⤵
        
        PID:2940
    - - C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4364
      - C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        7⤵
        
        PID:2428
      - C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        7⤵
        
        PID:3460
      - C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        8⤵
        
        PID:4544
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        8⤵
        
        PID:2964
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        9⤵
        
        PID:3992
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        9⤵
        
        PID:4996
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        10⤵
        
        PID:4220
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        10⤵
        
        PID:2144
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:244
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        11⤵
        
        PID:2176
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5960
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        11⤵
        
        PID:4352
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        12⤵
        
        PID:4544
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        12⤵
        
        PID:2164
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        13⤵
        
        PID:3552
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        13⤵
        
        PID:4680
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        14⤵
        
        PID:3400
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        14⤵
        
        PID:3372
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        15⤵
        
        PID:4340
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        15⤵
        
        PID:4292
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4248
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        15⤵
        
        PID:4580
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        16⤵
        
        PID:2260
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        15⤵
        
        PID:5728
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        16⤵
        
        PID:1764
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5400
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        16⤵
        
        PID:4964
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        17⤵
        
        PID:3332
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        16⤵
        
        PID:3940
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        17⤵
        
        PID:3612
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5972
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        17⤵
        
        PID:2100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        18⤵
        
        PID:3988
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        17⤵
        
        PID:3068
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        18⤵
        
        PID:6000
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6084
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        18⤵
        
        PID:5884
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        19⤵
        
        PID:3460
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        18⤵
        
        PID:2500
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        19⤵
        
        PID:3584
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1900
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        19⤵
        
        PID:2796
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        20⤵
        
        PID:3236
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        19⤵
        
        PID:5556
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        20⤵
        
        PID:632
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3284
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        20⤵
        
        PID:3996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        21⤵
        
        PID:5772
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        20⤵
        
        PID:2508
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        21⤵
        
        PID:2340
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        21⤵
        
        PID:4620
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        22⤵
        
        PID:4840
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        21⤵
        
        PID:3936
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        22⤵
        
        PID:6064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:4492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
- Drops file in System32 directory
PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:2980

C:\Program Files\RDP Wrapper\RDPWInst.exe
"C:\Program Files\RDP Wrapper\RDPWInst.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:5852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:3824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:1404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:4836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:5772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:1244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:4704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:4252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:6016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:5088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:4296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:4348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:4164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:2968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:2732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:2660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:5524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:5924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:4440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:5664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:5604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:4180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:4944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:1608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:5416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc
1⤵
PID:5492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f686aace6942fb7f7ceb231212eef4a4_332724ed-3c1a-4b0f-bd9b-045e18507ba6

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_332724ed-3c1a-4b0f-bd9b-045e18507ba6
Size 2KB
SHA256 cdce969dc52d5d49823327c45c71d0e2288be5204b3b05cf042fc0ba4ba29201
MD5 b1feadc643cb06bc4b4df6e4cb12dbf2
SHA1 6d4dccae7066df2f0416d9f8e6b406ba7bff4242
SHA512 474fcbe7a3fee994c607ca84c9cc94a30736bc9b7674bb9b2096a193822e9dab75d657dc1de477aa5854470b762dc9d0483eec0cf5d9e4f7ba096f38c95775ba
TLSH
T12D412BC797E01059D8C60339434FE5D064F7CA647CB3A1248306E41765974B22A57BEA
MD5 SHA1 SHA512 TLSH

Submit Download

3BF8.bat

Path C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\3BF7.tmp\3BF8.bat
Size 824B
SHA256 bf7f1043f7d151e06440c07aa91bd2c7048657515c12a0af8dea2becfe6802bd
MD5 1c04db7c0404d977651e89247b449fb5
SHA1 0de81ba7099f77efa9d387a4e334fdcc4f1cde5f
SHA512 0e8c6c0edb187ec58f8447779f3f60189b59b35100eec530befa83705fdc32933dcd572e2d31bedd9b3546b63147af48b4437802a5f69d63d606d560ae5c6b2c
TLSH
T1A501AF0C98A5F6B075423D5843483D1491069C1A228612FD3FDC075FEAEA6D8C2DE2D2
MD5 SHA1 SHA512 TLSH

Submit Download

H264_ON.pol

Path C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\H264_ON.pol
Size 186B
SHA256 213da1274863316dbf91aa4c725b86f23e37784912930ed951003608834a0b46
MD5 78952b476aa2e47bf0e27416acf6fe1f
SHA1 5543f22fe65fa4193008163107acd4ef8fbb338b
SHA512 5d4a1e4f13f01530ecfa399ac7e6db74403d4c1b3eed23f4fb0f068a387fde42d5651fadfbb9aad6a28c5a40345b70fb13c1e9210123157711622d9aab8fc21d
TLSH
T1ABC04C1143F41A56FAF56A71557329092C7B75565916851E0158810F0DB5EA4CF33327
MD5 SHA1 SHA512 TLSH

Submit Download

LGPO.exe

Path C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\LGPO.exe
Size 469KB
SHA256 0c97f29543418b30340c4ff5d930d31e6196dd59c2cc74b6b890fa7b90c910c7
MD5 fdf6c1f114a0fd2a144a6a126206461c
SHA1 bacfef8c102b1791ebe3229324cdf75da3171952
SHA512 9d941f1bb73c999f7f3c54f20a673fc4bc0342ba1d5c43e271e70f67294a63253878f8ab412e5b6ec39468e556c37dadeff0c167b22dd1bb675eca93d4e2cbce
SSDEEP 12288:km/Mfnx1+keV2XxPZ5OFV6h7+RHO8kyRpCX4DZVqFHdUk5xS8j0:KZEm+d2X4NVqc0xS8Y
TLSH
T1A6A47C1076A6C036E0F242301E79EF66557EB8254F7059CFB3D85A2E5A712C26A31F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDPWInst.exe

Path C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\RDPWInst.exe
Size 2.3MB
SHA256 d8b3001c86a1433524f1239c2a14a11d67009bba44dc3c686f295bcc0facc5a1
MD5 980d56ae0a529ba108d9194fb056f285
SHA1 d58d987989d1f44effb4bb29d06efb1c51f66718
SHA512 3852e5e8785a383717500b37b1f2a0a94cd3178b1d17bbebb9389ab230f93feccec7bdf6b14230230c84b485d163bfad464d89dcd8bc14a1cc28f9fc22ad90e7
SSDEEP 24576:jonfYwnqZ2tZ4DImIiXw2+6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKZmQ:XGmIi0pdqYH8ia6GcKZ37
TLSH
T1A0B56D15F2C8523ED45BD2359A325361E7BAB9442B209F8B39B40E4DDF2B2C02F36759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CnC.exe

Path C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\RDP_CnC.exe
Size 2.9MB
SHA256 5552c5ab33a144f420f1f1855392bd216c31385b4470b807f65017b310490c0e
MD5 08ed5177c4aa58aecb690243a7c60513
SHA1 eb4dda99c2201a2edcd4f2aee318f3775020da28
SHA512 32f713914b4d6514f9a33deed1d0cb34f521edd92d5868e8b3147e93f74dcb1e7264a54ecccd1c6ed27e870626a431581c4a6327c30df75369dde1b4d92323f9
SSDEEP 49152:w508rC2BkGRsj076sxNDlSkCtLyBCvDb3hU0Y+HLTU23tkjWdpX:w508rvBp2FyODb360Y+Mm8W
TLSH
T1E4E56D177A44787EC06A26366437D754993FEA70AA6BAC6717F40C8C8F357402E3E60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CnC.lnk

Path C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\RDP_CnC.lnk
Size 1KB
SHA256 83f134b45e9e28abd1e4a773f48c0303bc5f8b8b22f7fc12ee4fcb4011a7733d
MD5 bf5e6e967e6df74051e971d62ee9d282
SHA1 bcf85f18168b3b1e52d6f373afd8a3f81b6a7980
SHA512 6715f19c42555d25fc8e8eedf162ef2a7875f08a142251f58ddccc6df62b0b10cd33f397e8ab10b0eb0bb69d08ea4ec285b9bdd422121ee472d10bc3e42e165f
TLSH
T14431C21637DD2626E277E2B517B56501832BFC40B3921A3E808583C52CB15356169FAB
MD5 SHA1 SHA512 TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\3BF6.tmp\update.bat
Size 322B
SHA256 ab0cf42c898e0fcff6332094226312901d6afe2eab5598cf7eaccdaaea6ea3d9
MD5 8f9a5bf6d5331c46c8d9bc63700077fc
SHA1 4fa07a1599d5ae06416ab9004eca85511f534094
SHA512 9c9d66f85c46ae532e58b724deddf01394df68fa7194355b4c8e92d7a6f4652fec38bbaaead669823f0dc2c3bc06fcc35e12e58affa9d306e2076a277064f35e
TLSH
T1CCE07D0D5667A27BA4E03D548B996D12F00F015B56170BBD7EB1053DEE9C0C8A0DEDD3
MD5 SHA1 SHA512 TLSH

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 131B
SHA256 5d251ae6eb8a904a2b89c40fdb24ff66f494604632b78445a3060b6c607023a3
MD5 05c675fde739449d9b9ec775817f8776
SHA1 dfbcbb12e1aac62acca5271c6edf0e97a33a5608
SHA512 537f6ddbeb55959b6c1957a5a3fb8602e6462deab59dd5a24a8b60dc16da0b51aee9e25b882077fbbf12cfcae1e852a8b3c1c1faf9e8c07127099ab1d0fa11e4
TLSH
T1ECC02BA402202C2050160202C4EC203C55FC420C617020F9A31BD0BE67A3B31B899CD4
MD5 SHA1 SHA512 TLSH

Submit Download

rdpwrap.dll

Path \??\c:\program files\rdp wrapper\rdpwrap.dll
Size 114KB
SHA256 75fb4394ef5b8d1e7c74dfc61424101582ecdc406060caa9d66adea2ac8b37f8
MD5 0c2180b8e8cf57d168b0e5f388f90650
SHA1 dc6ba17b27e6611489c5c52f8956bc5a45001ecd
SHA512 8effc36cd55e0543219afa3df0d42e346ab8a6c67737977c24b4207281f490daf8f628614a745c26e6ef9f033a899c62378c99a8745e16c3e7935863c8f925ae
SSDEEP 3072:F3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVx:xMjTiVw2ve9LBMMpJsT
TLSH
T1F2B35B4773A100BBD4A7D638CDA34A52D7BA784656B1AB4F5790018A9F237E09E3CF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdpwrap.ini

Path \??\c:\program files\rdp wrapper\rdpwrap.ini
Size 541KB
SHA256 e3a803bfc3f05fbc02e08bf0fe6813a1f2216cc584202763303fe520e99c9711
MD5 8e16b25b8e123b3ba0db66d6feb3a50e
SHA1 33b010d709e884ffa61e257cf30ea00d24b4cf37
SHA512 2b5f217cb3c420e6cb93a52055edb391cc4bdcff51b732b0959bac0a5f6da95c9622db21b53b1875abdb21dcd86746ead85a301db83af6fad5f1f215f3a9dea7
SSDEEP 1536:Pu+1zn33L+MRIiG4IvREWddadl/FW/kKMPs11Sr:Pjd33L+MMdadl/FW/kek
TLSH
T1A0C4AE58F4C9577F5C0BE136FA3147B6E3F96D48AA503300FD3C5B6A6B8A2442B25A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-73-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/1504-99-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/1708-96-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/1900-120-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2176-103-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2460-69-0x0000000000400000-0x000000000065A000-memory.dmp

Download

memory/2716-93-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/3284-123-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/3352-90-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/3848-86-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/4112-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/4248-106-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/4264-80-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/4364-77-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/4764-83-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/4860-47-0x0000000000400000-0x000000000065A000-memory.dmp

Download

memory/4860-25-0x0000000000400000-0x000000000065A000-memory.dmp

Download

memory/5232-18-0x0000000000400000-0x000000000065A000-memory.dmp

Download

memory/5400-109-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/5972-113-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/6084-116-0x0000000000400000-0x0000000000709000-memory.dmp

Download