wannacry | c712ab1138d0dbccc4857d5b285ae54d75dd109452c22ad661b8869c5b9bbddf

General

Target

34881d8425c4344ef20acea47336e89a.exe
Size

3.6MB
MD5

34881d8425c4344ef20acea47336e89a
SHA1

00a4da44c4dfe13124198e914e5a8a7bbe4dcd15
SHA256

c712ab1138d0dbccc4857d5b285ae54d75dd109452c22ad661b8869c5b9bbddf
SHA512

9e4f32f17b097a241c86ca756b526bf98afb0728ccfc710edcca97955a253db59a53c4d143d2738b4cf7915404523e7958f7f9a85d03f8ac70e1df6f66f17639
SSDEEP

98304:JDqPoBhz1aRxcSUDk36SAI593R8yAVp2:JDqPe1Cxcxk3ZAIzR8yc4

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

34881d8425c4344ef20acea47336e89a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	34881d8425c4344ef20acea47336e89a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	34881d8425c4344ef20acea47336e89a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34881d8425c4344ef20acea47336e89a.exe:*:enabled:@shell32.dll,-1"	34881d8425c4344ef20acea47336e89a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	34881d8425c4344ef20acea47336e89a.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3304) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 1 IoCs

Processes:

34881d8425c4344ef20acea47336e89a.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 34881d8425c4344ef20acea47336e89a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4116 1912 WerFault.exe 34881d8425c4344ef20acea47336e89a.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	34881d8425c4344ef20acea47336e89a.exe

pid	pid_target	process	target process
4116	1912	WerFault.exe	34881d8425c4344ef20acea47336e89a.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

34881d8425c4344ef20acea47336e89a.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	34881d8425c4344ef20acea47336e89a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	34881d8425c4344ef20acea47336e89a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	34881d8425c4344ef20acea47336e89a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	34881d8425c4344ef20acea47336e89a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	34881d8425c4344ef20acea47336e89a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

34881d8425c4344ef20acea47336e89a.exe34881d8425c4344ef20acea47336e89a.exe

pid	process
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
2652	34881d8425c4344ef20acea47336e89a.exe
2652	34881d8425c4344ef20acea47336e89a.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

34881d8425c4344ef20acea47336e89a.exe

pid	process
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe
1912	34881d8425c4344ef20acea47336e89a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

34881d8425c4344ef20acea47336e89a.exe34881d8425c4344ef20acea47336e89a.exe

description pid process

Token: SeDebugPrivilege 1912 34881d8425c4344ef20acea47336e89a.exe
Token: SeDebugPrivilege 2652 34881d8425c4344ef20acea47336e89a.exe

description	pid	process
Token: SeDebugPrivilege	1912	34881d8425c4344ef20acea47336e89a.exe
Token: SeDebugPrivilege	2652	34881d8425c4344ef20acea47336e89a.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

34881d8425c4344ef20acea47336e89a.exe

description	pid	process	target process
PID 1912 wrote to memory of 620	1912	34881d8425c4344ef20acea47336e89a.exe	winlogon.exe
PID 1912 wrote to memory of 620	1912	34881d8425c4344ef20acea47336e89a.exe	winlogon.exe
PID 1912 wrote to memory of 620	1912	34881d8425c4344ef20acea47336e89a.exe	winlogon.exe
PID 1912 wrote to memory of 620	1912	34881d8425c4344ef20acea47336e89a.exe	winlogon.exe
PID 1912 wrote to memory of 620	1912	34881d8425c4344ef20acea47336e89a.exe	winlogon.exe
PID 1912 wrote to memory of 620	1912	34881d8425c4344ef20acea47336e89a.exe	winlogon.exe
PID 1912 wrote to memory of 680	1912	34881d8425c4344ef20acea47336e89a.exe	lsass.exe
PID 1912 wrote to memory of 680	1912	34881d8425c4344ef20acea47336e89a.exe	lsass.exe
PID 1912 wrote to memory of 680	1912	34881d8425c4344ef20acea47336e89a.exe	lsass.exe
PID 1912 wrote to memory of 680	1912	34881d8425c4344ef20acea47336e89a.exe	lsass.exe
PID 1912 wrote to memory of 680	1912	34881d8425c4344ef20acea47336e89a.exe	lsass.exe
PID 1912 wrote to memory of 680	1912	34881d8425c4344ef20acea47336e89a.exe	lsass.exe
PID 1912 wrote to memory of 784	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 784	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 784	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 784	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 784	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 784	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 792	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 792	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 792	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 792	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 792	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 792	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 800	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 800	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 800	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 800	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 800	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 800	1912	34881d8425c4344ef20acea47336e89a.exe	fontdrvhost.exe
PID 1912 wrote to memory of 908	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 908	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 908	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 908	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 908	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 908	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 960	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 960	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 960	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 960	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 960	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 960	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 332	1912	34881d8425c4344ef20acea47336e89a.exe	dwm.exe
PID 1912 wrote to memory of 332	1912	34881d8425c4344ef20acea47336e89a.exe	dwm.exe
PID 1912 wrote to memory of 332	1912	34881d8425c4344ef20acea47336e89a.exe	dwm.exe
PID 1912 wrote to memory of 332	1912	34881d8425c4344ef20acea47336e89a.exe	dwm.exe
PID 1912 wrote to memory of 332	1912	34881d8425c4344ef20acea47336e89a.exe	dwm.exe
PID 1912 wrote to memory of 332	1912	34881d8425c4344ef20acea47336e89a.exe	dwm.exe
PID 1912 wrote to memory of 440	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 440	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 440	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 440	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 440	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 440	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 724	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 724	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 724	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 724	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 724	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 724	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 1020	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 1020	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 1020	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe
PID 1912 wrote to memory of 1020	1912	34881d8425c4344ef20acea47336e89a.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:332

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3584

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
2⤵
PID:3500

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3412

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:4744

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
PID:3120

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:1500

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:4460

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3840

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
2⤵
PID:3668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1344

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3184

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2016

C:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exe
"C:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exe"
2⤵
- Modifies firewall policy service
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 1424
3⤵
- Program crash
PID:4116

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2528

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2076

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exe
C:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exe -m security
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1912 -ip 1912
1⤵
PID:4676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-132-0x0000000000400000-0x0000000000A82000-memory.dmp

Filesize
6.5MB

Download
memory/1912-134-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/1912-135-0x0000000000400000-0x0000000000A82000-memory.dmp

Filesize
6.5MB

Download
memory/1912-136-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/2652-133-0x0000000000400000-0x0000000000A82000-memory.dmp

Filesize
6.5MB

Download
memory/2652-137-0x0000000000400000-0x0000000000A82000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads