ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
Size

154KB
MD5

4654f073e9cb3e6ee988b8dd3c7301d0
SHA1

bca15a1a7b8bdf86f9d4cdc63df09b38b8ad8bc4
SHA256

ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a
SHA512

432bc0cadca9c20479615a19db1a82c5d31da5305d7b1de7e98a6ea9287e358e2193999cc52dacbb0fb453716b6db484d69250bf801bdbf8ae382869876b4882
SSDEEP

3072:9eK+8W3N8UdXXEB7QgCjRrlv2JL+Wr9/hUAodpMoF+V:9x+848yUB7mxg9mpdpMo

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe:*:enabled:@shell32.dll,-1"	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_65ab9a260dbf7467\basicdisplay.PNF	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\BIOS	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 588	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	3
PID 3172 wrote to memory of 588	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	3
PID 3172 wrote to memory of 588	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	3
PID 3172 wrote to memory of 588	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	3
PID 3172 wrote to memory of 588	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	3
PID 3172 wrote to memory of 588	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	3
PID 3172 wrote to memory of 676	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	1
PID 3172 wrote to memory of 676	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	1
PID 3172 wrote to memory of 676	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	1
PID 3172 wrote to memory of 676	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	1
PID 3172 wrote to memory of 676	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	1
PID 3172 wrote to memory of 676	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	1
PID 3172 wrote to memory of 784	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	8
PID 3172 wrote to memory of 784	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	8
PID 3172 wrote to memory of 784	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	8
PID 3172 wrote to memory of 784	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	8
PID 3172 wrote to memory of 784	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	8
PID 3172 wrote to memory of 784	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	8
PID 3172 wrote to memory of 792	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	80
PID 3172 wrote to memory of 792	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	80
PID 3172 wrote to memory of 792	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	80
PID 3172 wrote to memory of 792	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	80
PID 3172 wrote to memory of 792	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	80
PID 3172 wrote to memory of 792	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	80
PID 3172 wrote to memory of 800	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	79
PID 3172 wrote to memory of 800	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	79
PID 3172 wrote to memory of 800	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	79
PID 3172 wrote to memory of 800	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	79
PID 3172 wrote to memory of 800	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	79
PID 3172 wrote to memory of 800	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	79
PID 3172 wrote to memory of 908	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	78
PID 3172 wrote to memory of 908	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	78
PID 3172 wrote to memory of 908	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	78
PID 3172 wrote to memory of 908	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	78
PID 3172 wrote to memory of 908	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	78
PID 3172 wrote to memory of 908	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	78
PID 3172 wrote to memory of 956	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	77
PID 3172 wrote to memory of 956	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	77
PID 3172 wrote to memory of 956	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	77
PID 3172 wrote to memory of 956	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	77
PID 3172 wrote to memory of 956	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	77
PID 3172 wrote to memory of 956	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	77
PID 3172 wrote to memory of 312	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	9
PID 3172 wrote to memory of 312	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	9
PID 3172 wrote to memory of 312	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	9
PID 3172 wrote to memory of 312	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	9
PID 3172 wrote to memory of 312	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	9
PID 3172 wrote to memory of 312	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	9
PID 3172 wrote to memory of 440	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	10
PID 3172 wrote to memory of 440	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	10
PID 3172 wrote to memory of 440	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	10
PID 3172 wrote to memory of 440	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	10
PID 3172 wrote to memory of 440	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	10
PID 3172 wrote to memory of 440	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	10
PID 3172 wrote to memory of 868	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	76
PID 3172 wrote to memory of 868	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	76
PID 3172 wrote to memory of 868	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	76
PID 3172 wrote to memory of 868	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	76
PID 3172 wrote to memory of 868	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	76
PID 3172 wrote to memory of 868	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	76
PID 3172 wrote to memory of 900	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	11
PID 3172 wrote to memory of 900	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	11
PID 3172 wrote to memory of 900	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	11
PID 3172 wrote to memory of 900	3172	ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe	11

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3436
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3372
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:5096
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4472
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1900
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:640
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4700
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4204
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3736
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3520
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1196

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2688

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3032
- C:\Users\Admin\AppData\Local\Temp\ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe
  "C:\Users\Admin\AppData\Local\Temp\ef2c2d0dcb900656f2df72703cfbc6e8771fd82b3969ef2228a1048e0387340a.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2692

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2552

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1904

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3172-132-0x0000000001000000-0x000000000102C000-memory.dmp

Filesize
176KB

Download
memory/3172-133-0x0000000001000000-0x000000000102C000-memory.dmp

Filesize
176KB

Download