de709dacac623c637448dc91f6dfd441a49c89372af2c53e2027e4af5310b95d

Analysis

user interaction
yes
max time kernel
22s
max time network
9s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/10/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MPREXE.exe
Size 28KB
Sample261015-prf7gsds21
SHA256 de709dacac623c637448dc91f6dfd441a49c89372af2c53e2027e4af5310b95d
MD5 71c981d4f5316c3ad1deefe48fddb94a
SHA1 8e59bbdb29c4234bfcd0465bb6526154bd98b8e4
SHA512 e6ed88ce880e0bbb96995140df0999b1fb3bd45b3d0976e92f94be042d63b8f5030d346f3d24fbadd9822a98690a6d90ba000d9188b3946807fd77735c65c2b1
SSDEEP 768:6AAhTSe5L5gNRy0V3eU8HtsoeohmhwZRGX8:6AAXL5gNRy0ViHtsoe+gX8
TLSH
T1FDD2E0A8612C3944F3A493BF238647F414B459D47BAA03B38CA54648620F67DC5EBD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
2196	MPREXE.EXE
1472	msload.exe
3732	winsrv.exe
1704	DBGMODEL.EXE
3340	msload.exe
3464	msload.exe
4108	msload.exe
3976	scr.scr
5804	msload.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DBGMODEL = "C:\\WINDOWS\\DBGMODEL.EXE"	MPREXE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000\Software\Microsoft\Windows\CurrentVersion\Run\DIAGSVCS = "C:\\WINDOWS\\DIAGSVCS"	MPREXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	MPREXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	MPREXE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	MPREXE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	DBGMODEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	DBGMODEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	scr.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	winsrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	winsrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	MPREXE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	DBGMODEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	scr.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	scr.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	MPREXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	winsrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	winsrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	DBGMODEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	scr.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	MPREXE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	MPREXE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	MPREXE.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\msload.exe	scr.scr
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\system\scr.scr	msload.exe
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File opened for modification	\??\c:\windows\system\scr.scr	msload.exe
File created	C:\WINDOWS\MPREXE.EXE	winsrv.exe
File opened for modification	\??\c:\windows\system\scr.scr	winsrv.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	DBGMODEL.EXE
File opened for modification	\??\c:\windows\system\msload.exe	DBGMODEL.EXE
File created	\??\c:\windows\system\msload.exe	DBGMODEL.EXE
File opened for modification	\??\c:\windows\system\scr.scr	scr.scr
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\system\scr.scr	MPREXE.exe
File created	\??\c:\windows\system\scr.scr	MPREXE.exe
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File created	C:\WINDOWS\MPREXE.EXE	MPREXE.EXE
File created	\??\c:\windows\system\winsrv.exe	MPREXE.EXE
File opened for modification	\??\c:\windows\system\msload.exe	MPREXE.EXE
File created	\??\c:\windows\system\winsrv.exe	DBGMODEL.EXE
File opened for modification	\??\c:\windows\system\scr.scr	msload.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	winsrv.exe
File opened for modification	\??\c:\windows\system\scr.scr	msload.exe
File created	\??\c:\windows\system\winsrv.exe	MPREXE.exe
File opened for modification	C:\WINDOWS\MPREXE.EXE	MPREXE.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	DBGMODEL.EXE
File created	\??\c:\windows\system\msload.exe	winsrv.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	MPREXE.EXE
File opened for modification	C:\WINDOWS\MPREXE.EXE	scr.scr
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File opened for modification	C:\WINDOWS\DBGMODEL.EXE	MPREXE.exe
File opened for modification	C:\WINDOWS\MPREXE.EXE	winsrv.exe
File opened for modification	\??\c:\windows\system\msload.exe	winsrv.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File created	\??\c:\windows\system\winsrv.exe	winsrv.exe
File opened for modification	\??\c:\windows\system\scr.scr	DBGMODEL.EXE
File created	\??\c:\windows\system\msload.exe	scr.scr
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	MPREXE.exe
File opened for modification	\??\c:\windows\system\msload.exe	MPREXE.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File created	C:\WINDOWS\MPREXE.EXE	DBGMODEL.EXE
File opened for modification	C:\Windows\MSBIND.DLL	winsrv.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	MPREXE.exe
File created	C:\WINDOWS\DIAGSVCS	MPREXE.exe
File created	\??\c:\windows\system\scr.scr	scr.scr
File opened for modification	C:\WINDOWS\MPREXE.EXE	MPREXE.exe
File created	\??\c:\windows\system\msload.exe	MPREXE.EXE
File opened for modification	C:\WINDOWS\MPREXE.EXE	DBGMODEL.EXE
File opened for modification	\??\c:\windows\system\scr.scr	msload.exe
File created	C:\WINDOWS\MPREXE.EXE	MPREXE.exe
File created	\??\c:\windows\system\msload.exe	MPREXE.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	winsrv.exe
File opened for modification	\??\c:\windows\system\scr.scr	MPREXE.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	MPREXE.EXE
File created	C:\WINDOWS\DBGMODEL.EXE	MPREXE.exe
File created	\??\c:\windows\system\winsrv.exe	scr.scr
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File opened for modification	C:\WINDOWS\DIAGSVCS	MPREXE.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	scr.scr

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winsrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winsrv.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scr.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBGMODEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe
3516	MPREXE.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	MPREXE.exe
Token: SeDebugPrivilege	2196	MPREXE.EXE
Token: SeDebugPrivilege	1472	msload.exe
Token: SeShutdownPrivilege	1472	msload.exe
Token: SeDebugPrivilege	3732	winsrv.exe
Token: SeDebugPrivilege	1704	DBGMODEL.EXE
Token: SeDebugPrivilege	3340	msload.exe
Token: SeShutdownPrivilege	3340	msload.exe
Token: SeDebugPrivilege	4108	msload.exe
Token: SeShutdownPrivilege	4108	msload.exe
Token: SeDebugPrivilege	3464	msload.exe
Token: SeShutdownPrivilege	3464	msload.exe
Token: SeDebugPrivilege	3976	scr.scr
Token: SeDebugPrivilege	5804	msload.exe
Token: SeShutdownPrivilege	5804	msload.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4744	3516	MPREXE.exe	81
PID 3516 wrote to memory of 5088	3516	MPREXE.exe	82
PID 3516 wrote to memory of 4956	3516	MPREXE.exe	83
PID 3516 wrote to memory of 4204	3516	MPREXE.exe	84
PID 3516 wrote to memory of 3564	3516	MPREXE.exe	88
PID 4744 wrote to memory of 3296	4744	NET.exe	91
PID 4204 wrote to memory of 3368	4204	NET.exe	92
PID 4956 wrote to memory of 2264	4956	NET.exe	93
PID 5088 wrote to memory of 3696	5088	NET.exe	94
PID 3564 wrote to memory of 2764	3564	NET.exe	95
PID 1472 wrote to memory of 1652	1472	msload.exe	107
PID 1472 wrote to memory of 1692	1472	msload.exe	108
PID 1472 wrote to memory of 776	1472	msload.exe	109
PID 1472 wrote to memory of 2584	1472	msload.exe	110
PID 1472 wrote to memory of 248	1472	msload.exe	111
PID 3732 wrote to memory of 4948	3732	winsrv.exe	112
PID 3732 wrote to memory of 3576	3732	winsrv.exe	113
PID 3732 wrote to memory of 1492	3732	winsrv.exe	114
PID 3732 wrote to memory of 2212	3732	winsrv.exe	115
PID 3732 wrote to memory of 3412	3732	winsrv.exe	116
PID 2196 wrote to memory of 5004	2196	MPREXE.EXE	106
PID 2196 wrote to memory of 844	2196	MPREXE.EXE	117
PID 2196 wrote to memory of 2336	2196	MPREXE.EXE	128
PID 2196 wrote to memory of 3836	2196	MPREXE.EXE	129
PID 2196 wrote to memory of 1280	2196	MPREXE.EXE	130
PID 1704 wrote to memory of 4256	1704	DBGMODEL.EXE	137
PID 1704 wrote to memory of 2504	1704	DBGMODEL.EXE	138
PID 1704 wrote to memory of 3100	1704	DBGMODEL.EXE	139
PID 1704 wrote to memory of 1496	1704	DBGMODEL.EXE	140
PID 1704 wrote to memory of 3036	1704	DBGMODEL.EXE	141
PID 3732 wrote to memory of 3340	3732	winsrv.exe	147
PID 1652 wrote to memory of 3168	1652	NET.exe	148
PID 3576 wrote to memory of 3460	3576	NET.exe	149
PID 3340 wrote to memory of 4076	3340	msload.exe	150
PID 3340 wrote to memory of 8	3340	msload.exe	151
PID 3340 wrote to memory of 3376	3340	msload.exe	152
PID 3340 wrote to memory of 4328	3340	msload.exe	153
PID 3340 wrote to memory of 4984	3340	msload.exe	154
PID 1704 wrote to memory of 4108	1704	DBGMODEL.EXE	158
PID 2196 wrote to memory of 3464	2196	MPREXE.EXE	157
PID 4108 wrote to memory of 3512	4108	msload.exe	161
PID 3464 wrote to memory of 4028	3464	msload.exe	163
PID 4108 wrote to memory of 1412	4108	msload.exe	164
PID 3464 wrote to memory of 2128	3464	msload.exe	165
PID 3464 wrote to memory of 1364	3464	msload.exe	167
PID 3464 wrote to memory of 2328	3464	msload.exe	168
PID 3464 wrote to memory of 2216	3464	msload.exe	169
PID 4108 wrote to memory of 4276	4108	msload.exe	166
PID 4108 wrote to memory of 4300	4108	msload.exe	173
PID 4108 wrote to memory of 684	4108	msload.exe	174
PID 2584 wrote to memory of 1780	2584	NET.exe	182
PID 1692 wrote to memory of 916	1692	NET.exe	183
PID 3412 wrote to memory of 4360	3412	NET.exe	184
PID 3836 wrote to memory of 600	3836	NET.exe	185
PID 2212 wrote to memory of 4784	2212	NET.exe	186
PID 844 wrote to memory of 4864	844	NET.exe	187
PID 5004 wrote to memory of 1700	5004	NET.exe	251
PID 4948 wrote to memory of 2500	4948	NET.exe	190
PID 248 wrote to memory of 5176	248	NET.exe	193
PID 776 wrote to memory of 1940	776	NET.exe	250
PID 1492 wrote to memory of 5168	1492	NET.exe	192
PID 2336 wrote to memory of 5184	2336	NET.exe	194
PID 3100 wrote to memory of 5224	3100	NET.exe	195
PID 1496 wrote to memory of 5232	1496	NET.exe	196

C:\Users\Admin\AppData\Local\Temp\MPREXE.exe
"C:\Users\Admin\AppData\Local\Temp\MPREXE.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:3296
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:3696
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:2264
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:2764

C:\WINDOWS\MPREXE.EXE
C:\WINDOWS\MPREXE.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:1700
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:4864
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5184
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:600
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:5284
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4028
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5820
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:5768
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5956
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:2328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:5940
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5852
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5680
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:3144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:5684
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:3392
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5820
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:5156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:5692
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:2708
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:6028

\??\c:\windows\system\msload.exe
c:\windows\system\msload.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:3168
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:1940
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1780
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:5176
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:868
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5928
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5240
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:4740
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:1940
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:3876
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5144
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:5740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:3892
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:5348
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5340
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5296
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:5628
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:1148
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:5360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5652
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:5472
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912

\??\c:\windows\system\winsrv.exe
c:\windows\system\winsrv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:2500
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:5168
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:4784
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4360
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      System Location Discovery: System Language Discovery
      PID:5680
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:8
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:5300
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:3376
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5380
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:5688
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:4984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5760
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:2392
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5608
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:1884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:4832
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5320
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:4268
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:4492

C:\WINDOWS\DBGMODEL.EXE
C:\WINDOWS\DBGMODEL.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5320
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:5248
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:5224
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5232
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5240
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:3512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      System Location Discovery: System Language Discovery
      PID:5932
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:1412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:5780
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:4276
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5964
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:4300
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:5948
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:684
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5788
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3148
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:2024
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:4264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      System Location Discovery: System Language Discovery
      PID:6100
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5824
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:1852
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:2940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5428

\??\c:\windows\system\scr.scr
c:\windows\system\scr.scr
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3976
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:5276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5860
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:5328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:3884
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:5336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:4404
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5344
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:2372
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:5804
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5432
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:5600
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:5900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5368
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:5908
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:5496
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:5916
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      System Location Discovery: System Language Discovery
      PID:4916
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:5864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:4932
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:5860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:5708
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5136
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:3748
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:5704
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:6092
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MPREXE.EXE

Path C:\Windows\MPREXE.EXE
Size 28KB
SHA256 de709dacac623c637448dc91f6dfd441a49c89372af2c53e2027e4af5310b95d
MD5 71c981d4f5316c3ad1deefe48fddb94a
SHA1 8e59bbdb29c4234bfcd0465bb6526154bd98b8e4
SHA512 e6ed88ce880e0bbb96995140df0999b1fb3bd45b3d0976e92f94be042d63b8f5030d346f3d24fbadd9822a98690a6d90ba000d9188b3946807fd77735c65c2b1
SSDEEP 768:6AAhTSe5L5gNRy0V3eU8HtsoeohmhwZRGX8:6AAXL5gNRy0ViHtsoe+gX8
TLSH
T1FDD2E0A8612C3944F3A493BF238647F414B459D47BAA03B38CA54648620F67DC5EBD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msload.exe

Path C:\Windows\System\msload.exe
Size 12KB
SHA256 c93d4fe28aac9d63003c10585d7db9b32950af33387e45f1cd35d3c5dc128f47
MD5 9a53cd6b36825e500254fca152e1193b
SHA1 d18642e2d45e8886abc6b0fc57f9624e4c7321c5
SHA512 c5de4f00198ab3d27a77ccb9e1ced649dbe1aef6d7f68b94832693825517d032aa8e21ccf95f952e726ef4b8540e7a0402373dec07e4dda2fc6b49db00246328
SSDEEP 192:ns0rjlHb+p8ueAveAdTM3z1zngITYawNLmh1WTNjcNXdi:FjoeAveUT6zXT3ELmhUJcNXd
TLSH
T1EF42B0DF418CF07CF46255B3763891DBB4A137B44E0A6C868A648D4C3A2602B980E49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1472-64-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1472-12-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1472-61-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1472-48-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1704-20-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1704-34-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2196-37-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2196-11-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3340-53-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3464-35-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3464-55-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3516-41-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3516-0-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3732-62-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3732-65-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3732-17-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3732-51-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3976-46-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3976-40-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4108-57-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5804-60-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5804-47-0x0000000000400000-0x000000000040C000-memory.dmp

Download