c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58

Analysis

max time kernel
107s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
Size 160KB
Sample221003-vv3sjsgebk
SHA256 c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58
MD5 639eb1fcd08a84e338e913816ce29e2a
SHA1 de067268260a6e7bd8ec7900a2ca658a09314d5e
SHA512 067f2ebda0e33380f755074d9a32d8da1b9c6a942ff70a1c6219a797934c687eb90d090eeba1a9675369ffda6d843b378b271a6e7a121aa3191de72dd565ec63
SSDEEP 1536:faMmKEB9SeVOkNV9qpAUY539HpWwmgNkww5lx5lvLvEWgDAgvWSr3O2oFFgRX:R29xzP53PWwnzelxEA8r3O2oFiRX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe:*:enabled:@shell32.dll,-1"	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1656-132-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral2/memory/1656-133-0x0000000000400000-0x0000000000474000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3148	1656	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 608	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	3
PID 1656 wrote to memory of 608	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	3
PID 1656 wrote to memory of 608	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	3
PID 1656 wrote to memory of 608	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	3
PID 1656 wrote to memory of 608	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	3
PID 1656 wrote to memory of 608	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	3
PID 1656 wrote to memory of 676	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	1
PID 1656 wrote to memory of 676	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	1
PID 1656 wrote to memory of 676	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	1
PID 1656 wrote to memory of 676	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	1
PID 1656 wrote to memory of 676	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	1
PID 1656 wrote to memory of 676	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	1
PID 1656 wrote to memory of 788	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	8
PID 1656 wrote to memory of 788	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	8
PID 1656 wrote to memory of 788	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	8
PID 1656 wrote to memory of 788	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	8
PID 1656 wrote to memory of 788	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	8
PID 1656 wrote to memory of 788	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	8
PID 1656 wrote to memory of 796	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	81
PID 1656 wrote to memory of 796	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	81
PID 1656 wrote to memory of 796	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	81
PID 1656 wrote to memory of 796	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	81
PID 1656 wrote to memory of 796	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	81
PID 1656 wrote to memory of 796	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	81
PID 1656 wrote to memory of 804	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	80
PID 1656 wrote to memory of 804	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	80
PID 1656 wrote to memory of 804	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	80
PID 1656 wrote to memory of 804	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	80
PID 1656 wrote to memory of 804	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	80
PID 1656 wrote to memory of 804	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	80
PID 1656 wrote to memory of 912	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	9
PID 1656 wrote to memory of 912	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	9
PID 1656 wrote to memory of 912	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	9
PID 1656 wrote to memory of 912	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	9
PID 1656 wrote to memory of 912	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	9
PID 1656 wrote to memory of 912	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	9
PID 1656 wrote to memory of 972	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	11
PID 1656 wrote to memory of 972	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	11
PID 1656 wrote to memory of 972	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	11
PID 1656 wrote to memory of 972	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	11
PID 1656 wrote to memory of 972	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	11
PID 1656 wrote to memory of 972	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	11
PID 1656 wrote to memory of 408	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	10
PID 1656 wrote to memory of 408	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	10
PID 1656 wrote to memory of 408	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	10
PID 1656 wrote to memory of 408	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	10
PID 1656 wrote to memory of 408	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	10
PID 1656 wrote to memory of 408	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	10
PID 1656 wrote to memory of 540	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	12
PID 1656 wrote to memory of 540	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	12
PID 1656 wrote to memory of 540	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	12
PID 1656 wrote to memory of 540	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	12
PID 1656 wrote to memory of 540	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	12
PID 1656 wrote to memory of 540	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	12
PID 1656 wrote to memory of 424	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	79
PID 1656 wrote to memory of 424	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	79
PID 1656 wrote to memory of 424	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	79
PID 1656 wrote to memory of 424	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	79
PID 1656 wrote to memory of 424	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	79
PID 1656 wrote to memory of 424	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	79
PID 1656 wrote to memory of 932	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	13
PID 1656 wrote to memory of 932	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	13
PID 1656 wrote to memory of 932	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	13
PID 1656 wrote to memory of 932	1656	c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe	13

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:408
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:796

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1132
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2108

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2536

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2748

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2932
- C:\Users\Admin\AppData\Local\Temp\c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe
  "C:\Users\Admin\AppData\Local\Temp\c9f1da3b9171d72aafe2306d2e239942a1c636574cefb60c8687b27e4f221a58.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 372
    3⤵
    - Program crash
    PID:3148

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:392

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:5044

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:4820

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4628

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1656 -ip 1656
  2⤵
  PID:4612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4912

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3520

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3492

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3412

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-132-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/1656-133-0x0000000000400000-0x0000000000474000-memory.dmp

Download