b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148

Analysis

max time kernel
89s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Size

248KB
MD5

077b180937cf9a9c69e025687192599e
SHA1

67041cdee5d53672545ae50ce0868d620e7f299b
SHA256

b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148
SHA512

a0b1a1fe0a9455e5c71d0009faa3b65ead68cdf5507c1ccbb8793f1b93047fc06822c62b334be7335a5df4557605b7dc06001bc727b4704675804d286f6bda5d
SSDEEP

6144:020mD1xyOluAxO2ka6P36voO2ktamlupHbGuGlyGY:020mDnLuz2kzPeoO2ktamlupH6uenY

Score

8^/10

persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Spy-Net = "C:\\Program Files (x86)\\Spy-Net\\server.exe"	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Spy-Net = "C:\\Program Files (x86)\\Spy-Net\\server.exe"	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}\StubPath = "C:\\Program Files (x86)\\Spy-Net\\server.exe Restart"	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1252-68-0x0000000000260000-0x000000000026D000-memory.dmp	upx
behavioral1/memory/1252-72-0x0000000000270000-0x000000000027D000-memory.dmp	upx
behavioral1/memory/1252-76-0x0000000010450000-0x000000001045D000-memory.dmp	upx
behavioral1/memory/1252-82-0x0000000010460000-0x000000001046D000-memory.dmp	upx
behavioral1/memory/1252-88-0x0000000010470000-0x000000001047D000-memory.dmp	upx
behavioral1/memory/1252-94-0x0000000010480000-0x000000001048D000-memory.dmp	upx
behavioral1/memory/1252-100-0x0000000010490000-0x000000001049D000-memory.dmp	upx
behavioral1/memory/1252-106-0x00000000104A0000-0x00000000104AD000-memory.dmp	upx
behavioral1/memory/1252-112-0x00000000104B0000-0x00000000104BD000-memory.dmp	upx
behavioral1/memory/1252-118-0x00000000104C0000-0x00000000104CD000-memory.dmp	upx
behavioral1/memory/1252-124-0x00000000104D0000-0x00000000104DD000-memory.dmp	upx
behavioral1/memory/1252-130-0x00000000104E0000-0x00000000104ED000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spy-Net = "C:\\Program Files (x86)\\Spy-Net\\server.exe"	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Spy-Net = "C:\\Program Files (x86)\\Spy-Net\\server.exe"	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 1252	1768	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	27

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Spy-Net\logs.dat	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
File opened for modification	C:\Program Files (x86)\Spy-Net\logs.dat	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
File created	C:\Program Files (x86)\Spy-Net\server.exe	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
File opened for modification	C:\Program Files (x86)\Spy-Net\server.exe	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
File opened for modification	C:\Program Files (x86)\Spy-Net\plugin.dat	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
File opened for modification	C:\Program Files (x86)\Spy-Net\	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Token: SeDebugPrivilege	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Token: SeDebugPrivilege	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Token: SeDebugPrivilege	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Token: SeDebugPrivilege	1812	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
Token: SeDebugPrivilege	1812	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1252	1768	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	27
PID 1768 wrote to memory of 1252	1768	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	27
PID 1768 wrote to memory of 1252	1768	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	27
PID 1768 wrote to memory of 1252	1768	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	27
PID 1768 wrote to memory of 1252	1768	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	27
PID 1768 wrote to memory of 1252	1768	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	27
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28
PID 1252 wrote to memory of 840	1252	b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe	28

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:472

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1072
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1708
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1112
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:684
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:340
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:868
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:828
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:796
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:592

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:480

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1816

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
  "C:\Users\Admin\AppData\Local\Temp\b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
    C:\Users\Admin\AppData\Local\Temp\b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:840
  - - C:\Users\Admin\AppData\Local\Temp\b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
      C:\Users\Admin\AppData\Local\Temp\b946bfd7d0c873801df8a9941c14944a65fa91b0e6f24f583dbaa4efd1ab9148.exe
      4⤵
      Adds policy Run key to start application
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:1812

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-79-0x0000000010450000-0x000000001045D000-memory.dmp

Filesize
52KB

Download
memory/1252-88-0x0000000010470000-0x000000001047D000-memory.dmp

Filesize
52KB

Download
memory/1252-94-0x0000000010480000-0x000000001048D000-memory.dmp

Filesize
52KB

Download
memory/1252-58-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1252-59-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1252-61-0x0000000010410000-0x0000000010441000-memory.dmp

Filesize
196KB

Download
memory/1252-228-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1252-72-0x0000000000270000-0x000000000027D000-memory.dmp

Filesize
52KB

Download
memory/1252-76-0x0000000010450000-0x000000001045D000-memory.dmp

Filesize
52KB

Download
memory/1252-55-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1252-57-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1252-68-0x0000000000260000-0x000000000026D000-memory.dmp

Filesize
52KB

Download
memory/1252-118-0x00000000104C0000-0x00000000104CD000-memory.dmp

Filesize
52KB

Download
memory/1252-100-0x0000000010490000-0x000000001049D000-memory.dmp

Filesize
52KB

Download
memory/1252-106-0x00000000104A0000-0x00000000104AD000-memory.dmp

Filesize
52KB

Download
memory/1252-112-0x00000000104B0000-0x00000000104BD000-memory.dmp

Filesize
52KB

Download
memory/1252-82-0x0000000010460000-0x000000001046D000-memory.dmp

Filesize
52KB

Download
memory/1252-124-0x00000000104D0000-0x00000000104DD000-memory.dmp

Filesize
52KB

Download
memory/1252-130-0x00000000104E0000-0x00000000104ED000-memory.dmp

Filesize
52KB

Download
memory/1252-183-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1812-229-0x00000000105D0000-0x0000000010601000-memory.dmp

Filesize
196KB

Download
memory/1812-230-0x00000000105D0000-0x0000000010601000-memory.dmp

Filesize
196KB

Download