a2b98d7fe7d8d2296ae725603df287d1a9254567f08a6d3e7e96519a0515db60

Analysis

max time kernel
7s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ENXX0KJ7jtA.exe
Size 42.5MB
Sample260808-lrn1jsthne
SHA256 a2b98d7fe7d8d2296ae725603df287d1a9254567f08a6d3e7e96519a0515db60
MD5 c366ee304ec0500999e38c0f99b9948b
SHA1 401de091af88d88ae38b1e6135deeaf4c1ff3a50
SHA512 d548591f6dd86d6610913d2d948b420d4be047a3ab5a099bf1fd0df1a441d6e0000f7fb75aa73aa1023f89a5fee958c62c4d1e8cbdee6dde3d7375c7422375f2
SSDEEP 786432:DMadkj7Ls4Bz5iORN23GCQcYueLsvQjaWV+dmrkuV/pvJf1:IUELZNiOi3GCQvulvQmSnkuVRD
TLSH
T1C0A7331FD1847F6AED5003F4BC74E9812B64EE8BC3AD6D500E8B925B244B2BF4137A49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion execution persistence trojan

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	7ENXX0KJ7jtA.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7ENXX0KJ7jtA.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	7ENXX0KJ7jtA.exe

Modifies Windows Firewall 2 TTPs 10 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1080	netsh.exe
2596	netsh.exe
568	netsh.exe
4548	netsh.exe
3208	netsh.exe
2700	netsh.exe
6088	netsh.exe
2572	netsh.exe
4280	netsh.exe
4240	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7ENXX0KJ7jtA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7ENXX0KJ7jtA.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7ENXX0KJ7jtA.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7ENXX0KJ7jtA.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\cmd.exe	7ENXX0KJ7jtA.exe
File created	C:\Windows\System32\netsh.exe	7ENXX0KJ7jtA.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
6004	7ENXX0KJ7jtA.exe

Executes a command shell one-liner 1 TTPs 40 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1464	cmd.exe
5480	cmd.exe
1304	cmd.exe
1380	cmd.exe
2984	cmd.exe
688	cmd.exe
4992	cmd.exe
4948	cmd.exe
4084	cmd.exe
5912	cmd.exe
548	cmd.exe
1348	cmd.exe
5200	cmd.exe
5016	cmd.exe
2664	cmd.exe
5968	cmd.exe
6136	cmd.exe
5808	cmd.exe
5776	cmd.exe
2496	cmd.exe
1368	cmd.exe
4700	cmd.exe
4684	cmd.exe
2580	cmd.exe
5860	cmd.exe
1080	cmd.exe
824	cmd.exe
2032	cmd.exe
4304	cmd.exe
4100	cmd.exe
5692	cmd.exe
5660	cmd.exe
2040	cmd.exe
5528	cmd.exe
4148	cmd.exe
1776	cmd.exe
5388	cmd.exe
4144	cmd.exe
6060	cmd.exe
3140	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe
6004	7ENXX0KJ7jtA.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6004	7ENXX0KJ7jtA.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	7ENXX0KJ7jtA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 2496	6004	7ENXX0KJ7jtA.exe	89
PID 6004 wrote to memory of 2664	6004	7ENXX0KJ7jtA.exe	90
PID 6004 wrote to memory of 3140	6004	7ENXX0KJ7jtA.exe	91

C:\Users\Admin\AppData\Local\Temp\7ENXX0KJ7jtA.exe
"C:\Users\Admin\AppData\Local\Temp\7ENXX0KJ7jtA.exe"
1⤵
- Modifies visibility of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:4280
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:2464
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:1572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy reset >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2664
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy reset
    3⤵
    PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3140
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:6088
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:2712
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:2756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4144
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:4240
- - C:\Windows\system32\findstr.exe
    findstr /C:"State"
    3⤵
    PID:4956
- - C:\Windows\system32\findstr.exe
    findstr /C:"OFF"
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4084
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5480
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1
    3⤵
    PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 107.189.19.215 (Inbound)" | findstr 107.189.19.215 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 107.189.19.215 (Inbound)"
    3⤵
    - Modifies Windows Firewall
    PID:4548
- - C:\Windows\system32\findstr.exe
    findstr 107.189.19.215
    3⤵
    PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5968
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700
    3⤵
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="CRYPTAUTH 107.189.19.215 (Inbound)" dir=in action=block remoteip=107.189.19.215 enable=yes >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4684
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="CRYPTAUTH 107.189.19.215 (Inbound)" dir=in action=block remoteip=107.189.19.215 enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall show allprofiles | findstr /C:"State" | findstr /C:"OFF" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2984
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6060
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49
    3⤵
    PID:252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="CRYPTAUTH 107.189.19.215" | findstr 107.189.19.215 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2580
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="CRYPTAUTH 107.189.19.215"
    3⤵
    - Modifies Windows Firewall
    PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2040
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223
    3⤵
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6136
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5808
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f
    3⤵
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy show all
  2⤵
  - Executes a command shell one-liner
  PID:1368
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy show all
    3⤵
    PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy reset >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5860
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy reset
    3⤵
    PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5528
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:688
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1
    3⤵
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4700
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700
    3⤵
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1080
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49
    3⤵
    PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:824
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223
    3⤵
    PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22
    3⤵
    PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4148
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f
    3⤵
    PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy show all
  2⤵
  - Executes a command shell one-liner
  PID:548
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy show all
    3⤵
    PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy reset >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2032
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy reset
    3⤵
    PID:1652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4992
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    PID:5760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 192.168.1.1
    3⤵
    PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5776
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 2606:4700
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1776
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 172.67.199.49
    3⤵
    PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1348
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 104.21.68.223
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5388
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete address "Loopback Pseudo-Interface 1" 162.55.4.22
    3⤵
    PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4100
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PortProxy" /f
    3⤵
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy show all
  2⤵
  - Executes a command shell one-liner
  PID:4948
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy show all
    3⤵
    PID:3232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface portproxy reset >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5200
- - C:\Windows\system32\netsh.exe
    netsh interface portproxy reset
    3⤵
    PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5016
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns "Loopback Pseudo-Interface 1" dhcp
    3⤵
    PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysinfospoofer[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\sysinfospoofer[1].htm
Size 30B
SHA256 c0e0c3c955db5ea56d632a196a03a7176382861448a4706a75e998101ba86ffa
MD5 7d3bc9da8d698004e530b0f487cec19f
SHA1 193450c2f2f479c88f9b9a668b99614fc4cb2c95
SHA512 84c2aa421098cbb35d182f98e874b6f9fc97cc18666c34b96c06627aad6f28de1144be74593587feabd5606c9f9b6b68e63decf8ab1f99bfb39997f02339af21
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 c816b44762802a72fb687d66203d2a920087ab92dd60b59e52e5c63d003f0e2e
MD5 77f9c1b8812695ad246b5d5ff041d30c
SHA1 acc5bb57d7531864bcab260ffad0eb5be9977625
SHA512 9ce18ab93a5b906bc4dec41f09c7e78d2991e4359b9e7f8ee67414d7ced6d5df2c7808bd72a97b641a445db7ddb4a468d13d3fb526f606bf009377ada1a744fe
TLSH
T1FA2138C78E9AD2A5C362C2418975D015920750D10F9656EDB1CCFCAD3343739A684FF7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6004-36-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-245-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-3-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-0-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-49-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-97-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-158-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-211-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-2-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-4-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-289-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-321-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-329-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-361-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-412-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-435-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-490-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-548-0x0000000140000000-0x00000001463A5000-memory.dmp

Download

memory/6004-608-0x0000000140000000-0x00000001463A5000-memory.dmp

Download