wannacry | c2e8eab84c23134e367654536c0e40144e4c1c7ad5aaa09443dca439203bfca6

Analysis

max time kernel
151s
max time network
150s
platform
windows10_x64
resource
win10v20210408
submitted
20-04-2021 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Size

3.7MB
MD5

b110105b9654c61d6edc641c1b1c45d6
SHA1

a7ea2f9311cde3165d37b338588aaad276f3e7d0
SHA256

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da
SHA512

99b924113b5e036766d8538e290a10cfa1b6ebcc70a4dceb2fb48396290ab35e45920e6a90f8234d5fff2559d317880f157fcfc3a105e871f8c750291b477b11

Score

10^/10

wannacry evasion ransomware worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe:*:enabled:@shell32.dll,-1"	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2428 created 852 2428 WerFault.exe 2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

description	pid	process	target process
PID 2428 created 852	2428	WerFault.exe	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

Drops file in System32 directory 7 IoCs

Processes:

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\EURHJGI0.cookie	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\EURHJGI0.cookie	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

Drops file in Windows directory 1 IoCs

Processes:

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2428 852 WerFault.exe 2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

pid	pid_target	process	target process
2428	852	WerFault.exe	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exeWerFault.exe

pid	process
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
3264	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
3264	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe
2428	WerFault.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

pid	process
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
3264	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
3264	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
3264	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
3264	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Token: SeDebugPrivilege	3264	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
Token: SeRestorePrivilege	2428	WerFault.exe
Token: SeBackupPrivilege	2428	WerFault.exe
Token: SeDebugPrivilege	2428	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe

description	pid	process	target process
PID 852 wrote to memory of 548	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	winlogon.exe
PID 852 wrote to memory of 548	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	winlogon.exe
PID 852 wrote to memory of 548	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	winlogon.exe
PID 852 wrote to memory of 548	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	winlogon.exe
PID 852 wrote to memory of 548	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	winlogon.exe
PID 852 wrote to memory of 548	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	winlogon.exe
PID 852 wrote to memory of 628	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	lsass.exe
PID 852 wrote to memory of 628	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	lsass.exe
PID 852 wrote to memory of 628	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	lsass.exe
PID 852 wrote to memory of 628	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	lsass.exe
PID 852 wrote to memory of 628	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	lsass.exe
PID 852 wrote to memory of 628	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	lsass.exe
PID 852 wrote to memory of 712	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 712	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 712	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 712	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 712	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 712	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	fontdrvhost.exe
PID 852 wrote to memory of 728	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 728	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 728	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 728	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 728	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 728	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 796	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 796	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 796	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 796	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 796	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 796	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 844	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 844	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 844	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 844	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 844	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 844	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 884	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 884	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 884	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 884	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 884	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 884	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 976	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	dwm.exe
PID 852 wrote to memory of 976	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	dwm.exe
PID 852 wrote to memory of 976	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	dwm.exe
PID 852 wrote to memory of 976	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	dwm.exe
PID 852 wrote to memory of 976	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	dwm.exe
PID 852 wrote to memory of 976	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	dwm.exe
PID 852 wrote to memory of 296	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 296	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 296	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 296	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 296	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 296	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 392	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 392	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 392	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe
PID 852 wrote to memory of 392	852	2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:628

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:548

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:712

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:976

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:720

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1508

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2716

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3248

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:4020

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1904

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:2816

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3720

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3456

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3256

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:8

C:\Users\Admin\AppData\Local\Temp\2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
"C:\Users\Admin\AppData\Local\Temp\2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe"
2⤵
- Modifies firewall policy service
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 1260
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2684

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2676

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:2164

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2664

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2596

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2580

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2560

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2388

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2376

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2332

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2136

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1704

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2044

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1768

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1652

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1580

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1544

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1516

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1456

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1280

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1268

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1180

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:964

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:368

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:296

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:884

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:796

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2⤵
PID:3092

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:728

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:1104

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:1592

C:\Users\Admin\AppData\Local\Temp\2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe
C:\Users\Admin\AppData\Local\Temp\2b91b538f8fa67a38ef97641ce192ce737b0f2e13480c83ad666f3fa3e82f3da.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-114-0x000000007FE90000-0x000000007FE9C000-memory.dmp

Filesize
48KB

Download