ramnit | 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341

General

Target

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
Size

494KB
MD5

46ccdac4f0bbc0b6c8a411db9b058644
SHA1

5e69d0047113d4939cb909f5db0700f9e843ba44
SHA256

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341
SHA512

292b5ce3c7aba52a53fc756489dd82d48d93891334265478c1a4ace98c18cbc4ee1622e3889f8a9e783c7655585327769e7b28721edd5ff4c31ede206eb16a89

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe:*:enabled:@shell32.dll,-1"	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1632 created 4056 1632 WerFault.exe 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
Executes dropped EXE 1 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

pid process

4056 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

description	pid	process	target process
PID 1632 created 4056	1632	WerFault.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

pid	process
4056	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe	upx
C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\337DE1739B18E91DE064E9F50FA0EB5552AFE069012812B6CE29BE3B96DCD341SRV.EXE	upx
behavioral2/memory/4056-119-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px92D0.tmp	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1632 4056 WerFault.exe 337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

pid	pid_target	process	target process
1632	4056	WerFault.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exeWerFault.exe

pid	process
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe
1632	WerFault.exe

Suspicious behavior: MapViewOfSection 61 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

pid	process
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
Token: SeRestorePrivilege	1632	WerFault.exe
Token: SeBackupPrivilege	1632	WerFault.exe
Token: SeDebugPrivilege	1632	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe

description	pid	process	target process
PID 852 wrote to memory of 4056	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
PID 852 wrote to memory of 4056	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
PID 852 wrote to memory of 4056	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
PID 852 wrote to memory of 544	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 852 wrote to memory of 544	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 852 wrote to memory of 544	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 852 wrote to memory of 544	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 852 wrote to memory of 544	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 852 wrote to memory of 544	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	winlogon.exe
PID 852 wrote to memory of 624	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 852 wrote to memory of 624	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 852 wrote to memory of 624	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 852 wrote to memory of 624	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 852 wrote to memory of 624	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 852 wrote to memory of 624	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	lsass.exe
PID 852 wrote to memory of 708	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 708	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 708	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 708	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 708	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 708	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 720	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 720	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 728	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 728	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 728	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 728	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 728	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 728	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	fontdrvhost.exe
PID 852 wrote to memory of 792	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 792	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 792	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 792	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 792	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 792	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 840	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 840	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 840	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 840	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 840	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 840	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 888	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 888	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 888	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 888	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 888	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 888	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 976	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	dwm.exe
PID 852 wrote to memory of 976	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	dwm.exe
PID 852 wrote to memory of 976	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	dwm.exe
PID 852 wrote to memory of 976	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	dwm.exe
PID 852 wrote to memory of 976	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	dwm.exe
PID 852 wrote to memory of 976	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	dwm.exe
PID 852 wrote to memory of 340	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 340	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 340	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 340	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 340	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 340	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe
PID 852 wrote to memory of 396	852	337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:624

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:544

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:976

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:728

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:792

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3492

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:3524

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:2296

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3764

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
2⤵
PID:3264

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
2⤵
PID:3252

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2⤵
PID:2780

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1120

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1644

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe
"C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341.exe"
2⤵
- Modifies firewall policy service
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 476
4⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:1900

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2840

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2680

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:1816

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2652

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2608

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2588

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2500

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2440

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2432

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2356

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2168

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1608

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2016

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1952

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1800

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1612

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1588

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1472

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1464

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1412

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1332

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1324

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1184

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1088

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:64

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:888

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:840

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:720

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:1144

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:2464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\337DE1739B18E91DE064E9F50FA0EB5552AFE069012812B6CE29BE3B96DCD341SRV.EXE
MD5
d8ce8e59dc1b438493939ab9753807d0

SHA1
fa3ec7549a6f496749762cbed1038a2cb1951dca

SHA256
61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

SHA512
7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Download Submit
C:\Users\Admin\AppData\Local\Temp\337de1739b18e91de064e9f50fa0eb5552afe069012812b6ce29be3b96dcd341Srv.exe
MD5
d8ce8e59dc1b438493939ab9753807d0

SHA1
fa3ec7549a6f496749762cbed1038a2cb1951dca

SHA256
61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

SHA512
7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Download Submit
memory/852-120-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/4056-114-0x0000000000000000-mapping.dmp

Download
memory/4056-118-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/4056-116-0x000000007FEA0000-0x000000007FEAC000-memory.dmp

Filesize
48KB

Download
memory/4056-119-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads