67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
Size

330KB
MD5

6d2d17f32d10851b470a24e1ba8a3390
SHA1

81d97bac185c7b95772a563ec1877cc60666e7dd
SHA256

67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c
SHA512

719e06446ce9dd2b5004b8c33be37b6442efc993f80d38516e2bb62961fdc8da0a201a35ec2a4d5e0e4f8a44bd784e0901a31cfacc88202b41ae8653d0cd3456
SSDEEP

6144:2Y94NpBfMiwYTFClzmy0us8cBk8ObkyQvaH/ZZAcB84StdGeBo+jsX7nz/g3i8D:d9OPPxRCliy0uGOaAZFB84StdGeBoAsC

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe:*:enabled:@shell32.dll,-1"	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe

Executes dropped EXE 1 IoCs

pid	Process
1296	rinst.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\M:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\P:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\R:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\U:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\G:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\H:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\O:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\S:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\Q:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\V:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\W:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\X:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\E:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\J:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\L:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\N:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\Z:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\F:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\I:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\K:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
File opened (read-only)	\??\T:	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\inst.dat	rinst.exe
File created	C:\Windows\SysWOW64\rinst.exe	rinst.exe
File created	C:\Windows\SysWOW64\pk.bin	rinst.exe
File created	C:\Windows\SysWOW64\bpk.exe	rinst.exe
File created	C:\Windows\SysWOW64\bpkhk.dll	rinst.exe
File created	C:\Windows\SysWOW64\bpkwb.dll	rinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	1296	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1296	rinst.exe
1296	rinst.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe
1296	rinst.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	rinst.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1296	2752	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe	84
PID 2752 wrote to memory of 1296	2752	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe	84
PID 2752 wrote to memory of 1296	2752	67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe	84
PID 1296 wrote to memory of 612	1296	rinst.exe	1
PID 1296 wrote to memory of 612	1296	rinst.exe	1
PID 1296 wrote to memory of 612	1296	rinst.exe	1
PID 1296 wrote to memory of 612	1296	rinst.exe	1
PID 1296 wrote to memory of 612	1296	rinst.exe	1
PID 1296 wrote to memory of 612	1296	rinst.exe	1
PID 1296 wrote to memory of 676	1296	rinst.exe	2
PID 1296 wrote to memory of 676	1296	rinst.exe	2
PID 1296 wrote to memory of 676	1296	rinst.exe	2
PID 1296 wrote to memory of 676	1296	rinst.exe	2
PID 1296 wrote to memory of 676	1296	rinst.exe	2
PID 1296 wrote to memory of 676	1296	rinst.exe	2
PID 1296 wrote to memory of 780	1296	rinst.exe	8
PID 1296 wrote to memory of 780	1296	rinst.exe	8
PID 1296 wrote to memory of 780	1296	rinst.exe	8
PID 1296 wrote to memory of 780	1296	rinst.exe	8
PID 1296 wrote to memory of 780	1296	rinst.exe	8
PID 1296 wrote to memory of 780	1296	rinst.exe	8
PID 1296 wrote to memory of 784	1296	rinst.exe	80
PID 1296 wrote to memory of 784	1296	rinst.exe	80
PID 1296 wrote to memory of 784	1296	rinst.exe	80
PID 1296 wrote to memory of 784	1296	rinst.exe	80
PID 1296 wrote to memory of 784	1296	rinst.exe	80
PID 1296 wrote to memory of 784	1296	rinst.exe	80
PID 1296 wrote to memory of 772	1296	rinst.exe	79
PID 1296 wrote to memory of 772	1296	rinst.exe	79
PID 1296 wrote to memory of 772	1296	rinst.exe	79
PID 1296 wrote to memory of 772	1296	rinst.exe	79
PID 1296 wrote to memory of 772	1296	rinst.exe	79
PID 1296 wrote to memory of 772	1296	rinst.exe	79
PID 1296 wrote to memory of 896	1296	rinst.exe	78
PID 1296 wrote to memory of 896	1296	rinst.exe	78
PID 1296 wrote to memory of 896	1296	rinst.exe	78
PID 1296 wrote to memory of 896	1296	rinst.exe	78
PID 1296 wrote to memory of 896	1296	rinst.exe	78
PID 1296 wrote to memory of 896	1296	rinst.exe	78
PID 1296 wrote to memory of 948	1296	rinst.exe	10
PID 1296 wrote to memory of 948	1296	rinst.exe	10
PID 1296 wrote to memory of 948	1296	rinst.exe	10
PID 1296 wrote to memory of 948	1296	rinst.exe	10
PID 1296 wrote to memory of 948	1296	rinst.exe	10
PID 1296 wrote to memory of 948	1296	rinst.exe	10
PID 1296 wrote to memory of 1020	1296	rinst.exe	9
PID 1296 wrote to memory of 1020	1296	rinst.exe	9
PID 1296 wrote to memory of 1020	1296	rinst.exe	9
PID 1296 wrote to memory of 1020	1296	rinst.exe	9
PID 1296 wrote to memory of 1020	1296	rinst.exe	9
PID 1296 wrote to memory of 1020	1296	rinst.exe	9
PID 1296 wrote to memory of 432	1296	rinst.exe	16
PID 1296 wrote to memory of 432	1296	rinst.exe	16
PID 1296 wrote to memory of 432	1296	rinst.exe	16
PID 1296 wrote to memory of 432	1296	rinst.exe	16
PID 1296 wrote to memory of 432	1296	rinst.exe	16
PID 1296 wrote to memory of 432	1296	rinst.exe	16
PID 1296 wrote to memory of 728	1296	rinst.exe	11
PID 1296 wrote to memory of 728	1296	rinst.exe	11
PID 1296 wrote to memory of 728	1296	rinst.exe	11
PID 1296 wrote to memory of 728	1296	rinst.exe	11
PID 1296 wrote to memory of 728	1296	rinst.exe	11
PID 1296 wrote to memory of 728	1296	rinst.exe	11
PID 1296 wrote to memory of 692	1296	rinst.exe	12

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1364
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2004

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2676

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2640
- C:\Users\Admin\AppData\Local\Temp\67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe
  "C:\Users\Admin\AppData\Local\Temp\67a07c199ce5251db807bc1f3527bb792336ec125afe8ac5eea4716bb127368c.exe"
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 696
      4⤵
      Program crash
      PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2656

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3288

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3420

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3508

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3616

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3808

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:5016

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4252

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3380

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:3400

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4896

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 3b116ccdab2fdedac6bd2b5cbf3863d6 KggqobLsik+PdxEEA4enyA.0.1.0.0.0
1⤵
PID:1572
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4236

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1296 -ip 1296
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\RARSFX0\BPK.EXE

Filesize
214KB

MD5
5dd74b030107bc795b682f00a2fee943

SHA1
a9da9372f0ff19972d1ecc919a07b3ce05e64045

SHA256
d6b4cbd14592edfdec41e18dcbbf8fb5149f944653a7cae97352c8628efd28d5

SHA512
1d7638d2f73eb6ccddea24ddc5a811a70154f30eb56b30afb1ed7634b165e6e56e8dad0790d22e106e672c01d9ab3f24dedf5faecc9b62f9fece6f29b700af71

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkhk.dll

Filesize
24KB

MD5
58129986fa29f6dacd99ab45f60bcb3c

SHA1
7f21995794a060fc8629e0d113cf568de14c509e

SHA256
525414ffe5f797ebdd7de5620b75ff723de17bf8f399ffcd7ddec2d0b8a5dc4a

SHA512
62ade2d2eb41cd99dcd9f6d66e7966d129be20551faadcf827558e85d669f885ad144d10a87c3be7faed08103b86ab523fb6756b44f9e0ba77cdff586214701a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkwb.dll

Filesize
40KB

MD5
2e6016325548ab79e2d636640c6ec473

SHA1
586e2b84d46ef00e26c1686033def28e8a9995a5

SHA256
62e2948c3e3857e8304a657b7e7da30cdcb6842f71bd4c678a1734ebbf17198e

SHA512
1dc89b9e15f5835dff3203e278f000df5c0d8d93cbef5059be3f1024ef1e16ae8087a4f8e1131b20b190942984e9dc6079dfe951a52de7f4d4ad7de8721a0e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat

Filesize
996B

MD5
033300cd9317f46311769938d2927325

SHA1
28dbd9dbfe984f0a695bc544d5159c2387615d0e

SHA256
f12ccea94429018ec6cf41269ec28e809b48fd1bb331b311adba7414b593f696

SHA512
42f478622f180915b68e2423d5dde9b58a7e225a62adcfe202881b0c579f0c509075d57516acda73950b9ac420f2da35f0432938abe875074385facab0a87514

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin

Filesize
4KB

MD5
e92d3b693ed68bb050cfaa14891d5560

SHA1
9d00058794158397fd5c75ceaee958b9265eae4b

SHA256
0f8cb47b31274c15f42274825c78d4beb1f24eef36df005c036c05d589933e92

SHA512
4e79e309e6cec06639ca3005f3ec024c27728633bd9df4a66ed866b40daad8275f4e7c086c9fe1628a34da758a3587ce966d52f4c129db3278aeb46b84ff74c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe

Filesize
34KB

MD5
df0a23cbc7302f19b06fd079115e4545

SHA1
89325ead783ccdb682759ece5adc7b7d6b5bd2d1

SHA256
a565c05c6d616c3f3646304ab9cd43c704be0210187e0191b6e25bd8a7af4665

SHA512
c652d199ea42cbf21461910e537b4f87ebb351eb17bcd07dfb6b1810cba69600bcf09080e2507ded70bd5cd0939af244559fd45def9218c4ab571419801d10cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe

Filesize
34KB

MD5
df0a23cbc7302f19b06fd079115e4545

SHA1
89325ead783ccdb682759ece5adc7b7d6b5bd2d1

SHA256
a565c05c6d616c3f3646304ab9cd43c704be0210187e0191b6e25bd8a7af4665

SHA512
c652d199ea42cbf21461910e537b4f87ebb351eb17bcd07dfb6b1810cba69600bcf09080e2507ded70bd5cd0939af244559fd45def9218c4ab571419801d10cf

Download Submit
memory/1296-135-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1296-142-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2752-137-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/2752-143-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/2752-144-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download