Analysis
-
max time kernel
25s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-05-2021 05:13
Static task
static1
Behavioral task
behavioral1
Sample
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe
-
Size
2.7MB
-
MD5
24dd68cd18db86635d9f8b7217dfd846
-
SHA1
12e3fc5dd52c336a2b5e14a760e00d717dd5b60b
-
SHA256
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90
-
SHA512
14820d11ab81dd226d25d37d806cb90ac015e42d3ce0bd6540e0f3098f8eac4e6c79d4ebc4bc2c621c0828d5ff78a773a26232af1d2f15e24e95f56883683a9b
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 7 IoCs
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe:*:enabled:@shell32.dll,-1" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe -
Processes:
resource yara_rule behavioral2/memory/644-114-0x0000000002780000-0x000000000380E000-memory.dmp upx -
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe -
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe -
Drops file in Windows directory 1 IoCs
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exepid process 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe -
Suspicious behavior: MapViewOfSection 61 IoCs
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exepid process 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exedescription pid process Token: SeDebugPrivilege 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exedescription pid process target process PID 644 wrote to memory of 548 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe winlogon.exe PID 644 wrote to memory of 548 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe winlogon.exe PID 644 wrote to memory of 548 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe winlogon.exe PID 644 wrote to memory of 548 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe winlogon.exe PID 644 wrote to memory of 548 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe winlogon.exe PID 644 wrote to memory of 548 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe winlogon.exe PID 644 wrote to memory of 628 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe lsass.exe PID 644 wrote to memory of 628 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe lsass.exe PID 644 wrote to memory of 628 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe lsass.exe PID 644 wrote to memory of 628 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe lsass.exe PID 644 wrote to memory of 628 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe lsass.exe PID 644 wrote to memory of 628 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe lsass.exe PID 644 wrote to memory of 708 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 708 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 708 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 708 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 708 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 708 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 716 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 716 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 716 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 716 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 716 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 716 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 720 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 720 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 720 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 720 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 720 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 720 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe fontdrvhost.exe PID 644 wrote to memory of 792 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 792 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 792 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 792 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 792 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 792 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 836 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 836 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 836 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 836 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 836 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 836 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 892 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 892 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 892 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 892 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 892 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 892 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 980 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe dwm.exe PID 644 wrote to memory of 980 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe dwm.exe PID 644 wrote to memory of 980 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe dwm.exe PID 644 wrote to memory of 980 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe dwm.exe PID 644 wrote to memory of 980 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe dwm.exe PID 644 wrote to memory of 980 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe dwm.exe PID 644 wrote to memory of 340 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 340 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 340 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 340 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 340 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 340 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 368 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 368 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 368 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe PID 644 wrote to memory of 368 644 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:628
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:548
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:716
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:980
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s CryptSvc1⤵PID:2460
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3252
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:3612
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1008
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s CDPSvc1⤵PID:3324
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3724
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3484
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3260
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe"C:\Users\Admin\AppData\Local\Temp\94a0038548e86f96d5a68cf8ef86a390a032fd55151dc7304356befe51cf6c90.exe"2⤵
- Modifies firewall policy service
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:644
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2860
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2688
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2640
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2524
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2508
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:3652
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2500
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks1⤵PID:2492
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2452
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent1⤵PID:2380
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2372
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2360
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵PID:2192
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation1⤵PID:1456
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1984
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1900
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s StateRepository1⤵PID:1788
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s netprofm1⤵PID:1756
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1712
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1624
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵PID:1548
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s FontCache1⤵PID:1504
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder1⤵PID:1496
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵PID:1460
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1436
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1344
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵PID:1284
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1276
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵PID:1256
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵PID:1164
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵PID:1148
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1092
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵PID:1032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:832
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵PID:684
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵PID:368
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:340
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵PID:892
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k rpcss1⤵PID:836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:792
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding2⤵PID:732
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵PID:1572
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:720
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵PID:708
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵PID:3952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵PID:3232
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:1012
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/644-114-0x0000000002780000-0x000000000380E000-memory.dmpFilesize
16.6MB