4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b

Analysis

max time kernel
209s
max time network
238s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
Size

797KB
MD5

10bb88789942714dddc3b38c1267aed0
SHA1

8f99fec8d1fb00f42d620c030d8b085404a9e609
SHA256

4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b
SHA512

c34d15dead3f9711cf012da074193555d6f63acc9d87a18fd28734671d46919df60e6ca9bbc2b14a1332b1afb419842a42dea6028178a9d93520071aae4c6266
SSDEEP

12288:OQaO+Gxijy2LwsjZKjd3PMnMXwGreENKkiNmR:OQaOBijyhsdK5pXzyENKS

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe:*:enabled:@shell32.dll,-1"	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe

Executes dropped EXE 1 IoCs

pid	Process
2208	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2208-139-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/memory/760-140-0x0000000000400000-0x00000000004CC000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
2208	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3528	2208	WerFault.exe	83
3520	760	WerFault.exe	81
3856	2208	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
2208	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe
2208	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
Token: SeDebugPrivilege	2208	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2208	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	83
PID 760 wrote to memory of 2208	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	83
PID 760 wrote to memory of 2208	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	83
PID 760 wrote to memory of 616	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	76
PID 760 wrote to memory of 616	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	76
PID 760 wrote to memory of 616	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	76
PID 760 wrote to memory of 616	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	76
PID 760 wrote to memory of 616	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	76
PID 760 wrote to memory of 616	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	76
PID 760 wrote to memory of 680	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	1
PID 760 wrote to memory of 680	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	1
PID 760 wrote to memory of 680	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	1
PID 760 wrote to memory of 680	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	1
PID 760 wrote to memory of 680	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	1
PID 760 wrote to memory of 680	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	1
PID 760 wrote to memory of 788	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	3
PID 760 wrote to memory of 788	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	3
PID 760 wrote to memory of 788	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	3
PID 760 wrote to memory of 788	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	3
PID 760 wrote to memory of 788	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	3
PID 760 wrote to memory of 788	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	3
PID 760 wrote to memory of 800	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	2
PID 760 wrote to memory of 800	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	2
PID 760 wrote to memory of 800	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	2
PID 760 wrote to memory of 800	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	2
PID 760 wrote to memory of 800	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	2
PID 760 wrote to memory of 800	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	2
PID 760 wrote to memory of 808	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	74
PID 760 wrote to memory of 808	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	74
PID 760 wrote to memory of 808	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	74
PID 760 wrote to memory of 808	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	74
PID 760 wrote to memory of 808	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	74
PID 760 wrote to memory of 808	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	74
PID 760 wrote to memory of 912	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	73
PID 760 wrote to memory of 912	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	73
PID 760 wrote to memory of 912	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	73
PID 760 wrote to memory of 912	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	73
PID 760 wrote to memory of 912	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	73
PID 760 wrote to memory of 912	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	73
PID 760 wrote to memory of 960	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	5
PID 760 wrote to memory of 960	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	5
PID 760 wrote to memory of 960	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	5
PID 760 wrote to memory of 960	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	5
PID 760 wrote to memory of 960	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	5
PID 760 wrote to memory of 960	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	5
PID 760 wrote to memory of 376	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	4
PID 760 wrote to memory of 376	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	4
PID 760 wrote to memory of 376	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	4
PID 760 wrote to memory of 376	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	4
PID 760 wrote to memory of 376	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	4
PID 760 wrote to memory of 376	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	4
PID 760 wrote to memory of 388	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	72
PID 760 wrote to memory of 388	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	72
PID 760 wrote to memory of 388	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	72
PID 760 wrote to memory of 388	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	72
PID 760 wrote to memory of 388	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	72
PID 760 wrote to memory of 388	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	72
PID 760 wrote to memory of 664	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	71
PID 760 wrote to memory of 664	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	71
PID 760 wrote to memory of 664	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	71
PID 760 wrote to memory of 664	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	71
PID 760 wrote to memory of 664	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	71
PID 760 wrote to memory of 664	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	71
PID 760 wrote to memory of 632	760	4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe	6

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3644
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:552
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1532
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4796
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4564
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3872
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3724
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3468
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3380
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:1444

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2120

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2208 -ip 2208
  2⤵
  PID:32
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 760 -ip 760
  2⤵
  PID:3488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2208 -ip 2208
  2⤵
  PID:3868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3196

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:740
- C:\Users\Admin\AppData\Local\Temp\4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe
  "C:\Users\Admin\AppData\Local\Temp\4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212b.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Users\Admin\AppData\Local\Temp\4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe
    C:\Users\Admin\AppData\Local\Temp\4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 528
      4⤵
      Program crash
      PID:3528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 604
      4⤵
      Program crash
      PID:3856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 476
    3⤵
    - Program crash
    PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2680

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2604

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2164

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:808

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe

Filesize
397KB

MD5
24e8ba40eeb1ca484ac1413d9ae87d6b

SHA1
469ed69bc5e05e9e1f43225582de39edf7fd971e

SHA256
aeccd3d95899034617d5fbcb2378a1f48ffa23cf04d8af0fd35b5be237ebb104

SHA512
6d2a83071e25bdef226203ee408d9957eab8b68634b9e7d9bc794b0cc1b5be7aa73fae1350860258437d7a8aaec8a0fd41f7a09a689c9fead266f0595d6f098e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4b5d7695cd87c8917386f0da93001a79753371eab583dc23d4f1851e3523212bmgr.exe

Filesize
397KB

MD5
24e8ba40eeb1ca484ac1413d9ae87d6b

SHA1
469ed69bc5e05e9e1f43225582de39edf7fd971e

SHA256
aeccd3d95899034617d5fbcb2378a1f48ffa23cf04d8af0fd35b5be237ebb104

SHA512
6d2a83071e25bdef226203ee408d9957eab8b68634b9e7d9bc794b0cc1b5be7aa73fae1350860258437d7a8aaec8a0fd41f7a09a689c9fead266f0595d6f098e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~TMD8FB.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\~TMDA14.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
memory/760-141-0x0000000002630000-0x00000000026FC000-memory.dmp

Filesize
816KB

Download
memory/760-140-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/760-133-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/760-143-0x000000007FE30000-0x000000007FE3B000-memory.dmp

Filesize
44KB

Download
memory/760-146-0x00000000772E0000-0x0000000077483000-memory.dmp

Filesize
1.6MB

Download
memory/760-148-0x00000000772E0000-0x0000000077483000-memory.dmp

Filesize
1.6MB

Download
memory/2208-139-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2208-142-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/2208-144-0x0000000002200000-0x0000000002268000-memory.dmp

Filesize
416KB

Download
memory/2208-145-0x00000000772E0000-0x0000000077483000-memory.dmp

Filesize
1.6MB

Download
memory/2208-147-0x00000000772E0000-0x0000000077483000-memory.dmp

Filesize
1.6MB

Download