Analysis
-
max time kernel
143s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 04:03
Static task
static1
Behavioral task
behavioral1
Sample
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe
Resource
win10v2004-20220812-en
General
-
Target
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe
-
Size
672KB
-
MD5
537d4dcf1d332bf09437b0d11549b1c0
-
SHA1
6bd50743a64544b7901801ba456693c5d658c40f
-
SHA256
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818
-
SHA512
e87da0d8f7518d259d3e382597f3d5cbcb884d6913850bd715db19f797d12c6b15775b2b37705223500cbacde6c2e15372433a165a4f4aadb1c03a6c70068450
-
SSDEEP
6144:7dbELf/MR/cWdi5pV/JNWOVhMUVbELf/MR/e6xW1MFbKZ871HSrhVDeEt4169rBT:BdOpNX1hQ18bKKiZG16/
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe:*:enabled:@shell32.dll,-1" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Alerter = "C:\\Program Files\\Windows Alerter\\WinAlert.exe" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Common Files Manager = "C:\\Program Files\\Windows Common Files\\Commgr.exe" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowMessenger = "C:\\RECYCLER\\X-1-5-21-1960408961-725345543-839522115-1003\\WinSysApp.exe" 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3512 4288 WerFault.exe 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Modifies registry class 1 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exepid process 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exepid process 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exedescription pid process Token: SeDebugPrivilege 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe Token: SeDebugPrivilege 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exedescription pid process target process PID 4288 wrote to memory of 632 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe winlogon.exe PID 4288 wrote to memory of 632 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe winlogon.exe PID 4288 wrote to memory of 632 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe winlogon.exe PID 4288 wrote to memory of 632 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe winlogon.exe PID 4288 wrote to memory of 632 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe winlogon.exe PID 4288 wrote to memory of 632 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe winlogon.exe PID 4288 wrote to memory of 688 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe lsass.exe PID 4288 wrote to memory of 688 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe lsass.exe PID 4288 wrote to memory of 688 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe lsass.exe PID 4288 wrote to memory of 688 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe lsass.exe PID 4288 wrote to memory of 688 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe lsass.exe PID 4288 wrote to memory of 688 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe lsass.exe PID 4288 wrote to memory of 796 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 796 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 796 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 796 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 796 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 796 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 804 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 804 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 804 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 804 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 804 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 804 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 812 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 812 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 812 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 812 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 812 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 812 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe fontdrvhost.exe PID 4288 wrote to memory of 916 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 916 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 916 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 916 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 916 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 916 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 972 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 972 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 972 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 972 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 972 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 972 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 404 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe dwm.exe PID 4288 wrote to memory of 404 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe dwm.exe PID 4288 wrote to memory of 404 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe dwm.exe PID 4288 wrote to memory of 404 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe dwm.exe PID 4288 wrote to memory of 404 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe dwm.exe PID 4288 wrote to memory of 404 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe dwm.exe PID 4288 wrote to memory of 440 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 440 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 440 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 440 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 440 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 440 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 672 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 672 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 672 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 672 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 672 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 672 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 388 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 388 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 388 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe PID 4288 wrote to memory of 388 4288 4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe"C:\Users\Admin\AppData\Local\Temp\4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 28723⤵
- Program crash
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4288 -ip 42881⤵