Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
db28383ba1d804c5c224bfb865d71f14.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
db28383ba1d804c5c224bfb865d71f14.exe
Resource
win10v2004-20220812-en
General
-
Target
db28383ba1d804c5c224bfb865d71f14.exe
-
Size
3.6MB
-
MD5
db28383ba1d804c5c224bfb865d71f14
-
SHA1
8e7286ca8cb98cc4804c8bb917e43ead79480506
-
SHA256
cf713cb4ecf1aee0756285012464f6b9e9e46a6d15afa432faf8c4d3576e8f73
-
SHA512
b7436ca4b2acf89080caafb37e2252ebf5ffa5e2caf06bcc7e57c033f83a5724e34cda237eab03cd484e427a8ad35d2fcf7ddb4008e12493344776b73853442f
-
SSDEEP
24576:xbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqvO1Dq:xnAQqMSPbcBVQej/zOhq
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db28383ba1d804c5c224bfb865d71f14.exe:*:enabled:@shell32.dll,-1" db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications db28383ba1d804c5c224bfb865d71f14.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3119) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedescription ioc process File created C:\WINDOWS\tasksche.exe db28383ba1d804c5c224bfb865d71f14.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1780 4528 WerFault.exe db28383ba1d804c5c224bfb865d71f14.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" db28383ba1d804c5c224bfb865d71f14.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedb28383ba1d804c5c224bfb865d71f14.exepid process 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 5032 db28383ba1d804c5c224bfb865d71f14.exe 5032 db28383ba1d804c5c224bfb865d71f14.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exepid process 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe 4528 db28383ba1d804c5c224bfb865d71f14.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedb28383ba1d804c5c224bfb865d71f14.exedescription pid process Token: SeDebugPrivilege 4528 db28383ba1d804c5c224bfb865d71f14.exe Token: SeDebugPrivilege 5032 db28383ba1d804c5c224bfb865d71f14.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedescription pid process target process PID 4528 wrote to memory of 624 4528 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 4528 wrote to memory of 624 4528 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 4528 wrote to memory of 624 4528 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 4528 wrote to memory of 624 4528 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 4528 wrote to memory of 624 4528 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 4528 wrote to memory of 624 4528 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 4528 wrote to memory of 680 4528 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 4528 wrote to memory of 680 4528 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 4528 wrote to memory of 680 4528 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 4528 wrote to memory of 680 4528 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 4528 wrote to memory of 680 4528 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 4528 wrote to memory of 680 4528 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 4528 wrote to memory of 780 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 780 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 780 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 780 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 780 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 780 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 784 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 784 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 784 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 784 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 784 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 784 4528 db28383ba1d804c5c224bfb865d71f14.exe fontdrvhost.exe PID 4528 wrote to memory of 804 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 804 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 804 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 804 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 804 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 804 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 916 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 916 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 916 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 916 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 916 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 916 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 964 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 964 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 964 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 964 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 964 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 964 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 388 4528 db28383ba1d804c5c224bfb865d71f14.exe dwm.exe PID 4528 wrote to memory of 388 4528 db28383ba1d804c5c224bfb865d71f14.exe dwm.exe PID 4528 wrote to memory of 388 4528 db28383ba1d804c5c224bfb865d71f14.exe dwm.exe PID 4528 wrote to memory of 388 4528 db28383ba1d804c5c224bfb865d71f14.exe dwm.exe PID 4528 wrote to memory of 388 4528 db28383ba1d804c5c224bfb865d71f14.exe dwm.exe PID 4528 wrote to memory of 388 4528 db28383ba1d804c5c224bfb865d71f14.exe dwm.exe PID 4528 wrote to memory of 524 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 524 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 524 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 524 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 524 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 524 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 876 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 876 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 876 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 876 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 876 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 876 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 908 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 908 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 908 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 4528 wrote to memory of 908 4528 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exe"C:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exe"2⤵
- Modifies firewall policy service
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 14323⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exeC:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exe -m security1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4528 -ip 45281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4528-135-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/4528-137-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/4528-138-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/4528-139-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/5032-136-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/5032-140-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB