472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57

Analysis

max time kernel
149s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
Size

48KB
MD5

6a0ffb36a4e66aed5b32391e824f3cfa
SHA1

20ca98864621bc3fd6e413e8e102f442b1502d5a
SHA256

472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57
SHA512

83b6dc83c6de22f155c4d8f595ea2aa1f8f13a263f27e162be60e20ef8aeeab436eb5055abd674c670bede8e3c7860a0f8cb37d956adb938b7430af3c9a8af77
SSDEEP

768:WRU+NbykfR3PfG/qX4yI85JHxanwLvw4CFgHdtZw83F6Yi6asBUQxpm:WtR33GCX4CxawjZVH1Z8WLjp

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe:*:enabled:@shell32.dll,-1"	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "%SystemRoot%\\system32\\nwcwks.dll"	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4244-132-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4244-133-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4244-136-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe

Loads dropped DLL 1 IoCs

pid	Process
1116	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nwcwks.dll	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
File opened for modification	C:\WINDOWS\SysWOW64\CMD.EXE	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
392	4244	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
Token: SeTakeOwnershipPrivilege	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
Token: SeRestorePrivilege	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
Token: SeBackupPrivilege	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
Token: SeChangeNotifyPrivilege	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 612	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	3
PID 4244 wrote to memory of 612	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	3
PID 4244 wrote to memory of 612	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	3
PID 4244 wrote to memory of 612	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	3
PID 4244 wrote to memory of 612	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	3
PID 4244 wrote to memory of 612	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	3
PID 4244 wrote to memory of 680	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	1
PID 4244 wrote to memory of 680	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	1
PID 4244 wrote to memory of 680	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	1
PID 4244 wrote to memory of 680	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	1
PID 4244 wrote to memory of 680	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	1
PID 4244 wrote to memory of 680	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	1
PID 4244 wrote to memory of 792	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	75
PID 4244 wrote to memory of 792	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	75
PID 4244 wrote to memory of 792	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	75
PID 4244 wrote to memory of 792	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	75
PID 4244 wrote to memory of 792	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	75
PID 4244 wrote to memory of 792	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	75
PID 4244 wrote to memory of 800	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	74
PID 4244 wrote to memory of 800	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	74
PID 4244 wrote to memory of 800	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	74
PID 4244 wrote to memory of 800	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	74
PID 4244 wrote to memory of 800	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	74
PID 4244 wrote to memory of 800	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	74
PID 4244 wrote to memory of 808	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	73
PID 4244 wrote to memory of 808	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	73
PID 4244 wrote to memory of 808	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	73
PID 4244 wrote to memory of 808	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	73
PID 4244 wrote to memory of 808	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	73
PID 4244 wrote to memory of 808	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	73
PID 4244 wrote to memory of 920	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	8
PID 4244 wrote to memory of 920	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	8
PID 4244 wrote to memory of 920	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	8
PID 4244 wrote to memory of 920	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	8
PID 4244 wrote to memory of 920	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	8
PID 4244 wrote to memory of 920	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	8
PID 4244 wrote to memory of 972	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	72
PID 4244 wrote to memory of 972	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	72
PID 4244 wrote to memory of 972	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	72
PID 4244 wrote to memory of 972	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	72
PID 4244 wrote to memory of 972	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	72
PID 4244 wrote to memory of 972	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	72
PID 4244 wrote to memory of 400	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	9
PID 4244 wrote to memory of 400	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	9
PID 4244 wrote to memory of 400	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	9
PID 4244 wrote to memory of 400	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	9
PID 4244 wrote to memory of 400	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	9
PID 4244 wrote to memory of 400	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	9
PID 4244 wrote to memory of 376	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	10
PID 4244 wrote to memory of 376	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	10
PID 4244 wrote to memory of 376	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	10
PID 4244 wrote to memory of 376	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	10
PID 4244 wrote to memory of 376	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	10
PID 4244 wrote to memory of 376	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	10
PID 4244 wrote to memory of 668	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	71
PID 4244 wrote to memory of 668	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	71
PID 4244 wrote to memory of 668	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	71
PID 4244 wrote to memory of 668	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	71
PID 4244 wrote to memory of 668	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	71
PID 4244 wrote to memory of 668	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	71
PID 4244 wrote to memory of 968	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	11
PID 4244 wrote to memory of 968	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	11
PID 4244 wrote to memory of 968	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	11
PID 4244 wrote to memory of 968	4244	472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe	11

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:400
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1172
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:2524
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1932

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2772

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3292

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:876

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1940

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4988

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3604

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3436

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2792
- C:\Users\Admin\AppData\Local\Temp\472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe
  "C:\Users\Admin\AppData\Local\Temp\472943d7cb41f78cc963b4a0b7f12cca7886920ee869d78154f87efc1fc14c57.exe"
  2⤵
  - Modifies firewall policy service
  - Sets DLL path for service in the registry
  - Checks computer location settings
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1660
    3⤵
    - Program crash
    PID:392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2676

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:808

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4244 -ip 4244
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\nwcwks.dll

Filesize
8KB

MD5
6ecf985cb1a3f2d7f5525d55bcf4bb8b

SHA1
240ff5600f273da2475aa18003fcda4e352fea13

SHA256
bff80bc0f86790a87f1010edfc31e2ad9ea712321f63e1129e3181ed57fe9b2b

SHA512
5d316fcd427ccc3e193c4575a8cdd964792f9630326fdf3530d6a727eaddd32bd008834b3385f114a8ddd96245b467915d879904321579142c129f8694842acd

Download Submit
\??\c:\windows\SysWOW64\nwcwks.dll

Filesize
8KB

MD5
6ecf985cb1a3f2d7f5525d55bcf4bb8b

SHA1
240ff5600f273da2475aa18003fcda4e352fea13

SHA256
bff80bc0f86790a87f1010edfc31e2ad9ea712321f63e1129e3181ed57fe9b2b

SHA512
5d316fcd427ccc3e193c4575a8cdd964792f9630326fdf3530d6a727eaddd32bd008834b3385f114a8ddd96245b467915d879904321579142c129f8694842acd

Download Submit
memory/4244-132-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4244-133-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4244-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download