28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a

Analysis

max time kernel
79s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
Size

89KB
MD5

20d66c119dda51e51b058ddff50dc0ba
SHA1

55f8821cfe882dba8a71c0412322f9ab0e1d653b
SHA256

28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a
SHA512

718ba68d152af0afac6d4aba919d79f4c18305772819a6ec9aa328fd5bd21e2f39eb06eacff1ad56e458e536b082c7a904b61bc8ad48d313f52046d6f3a1327d
SSDEEP

1536:B4LDcIXdWqw4uhJvv5mRwLsDr27cqC15sxNceGh83+lf5bfjB5AOB7vTi:B6lX44O5mRhDr27cqg5KcebODjTT

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe:*:enabled:@shell32.dll,-1"	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\SETUP_WM.EXE	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	4812	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
Token: SeTakeOwnershipPrivilege	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
Token: SeRestorePrivilege	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
Token: SeBackupPrivilege	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
Token: SeChangeNotifyPrivilege	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 620	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	3
PID 4812 wrote to memory of 620	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	3
PID 4812 wrote to memory of 620	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	3
PID 4812 wrote to memory of 620	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	3
PID 4812 wrote to memory of 620	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	3
PID 4812 wrote to memory of 620	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	3
PID 4812 wrote to memory of 672	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	1
PID 4812 wrote to memory of 672	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	1
PID 4812 wrote to memory of 672	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	1
PID 4812 wrote to memory of 672	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	1
PID 4812 wrote to memory of 672	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	1
PID 4812 wrote to memory of 672	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	1
PID 4812 wrote to memory of 780	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	9
PID 4812 wrote to memory of 780	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	9
PID 4812 wrote to memory of 780	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	9
PID 4812 wrote to memory of 780	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	9
PID 4812 wrote to memory of 780	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	9
PID 4812 wrote to memory of 780	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	9
PID 4812 wrote to memory of 788	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	8
PID 4812 wrote to memory of 788	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	8
PID 4812 wrote to memory of 788	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	8
PID 4812 wrote to memory of 788	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	8
PID 4812 wrote to memory of 788	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	8
PID 4812 wrote to memory of 788	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	8
PID 4812 wrote to memory of 796	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	13
PID 4812 wrote to memory of 796	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	13
PID 4812 wrote to memory of 796	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	13
PID 4812 wrote to memory of 796	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	13
PID 4812 wrote to memory of 796	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	13
PID 4812 wrote to memory of 796	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	13
PID 4812 wrote to memory of 900	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	12
PID 4812 wrote to memory of 900	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	12
PID 4812 wrote to memory of 900	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	12
PID 4812 wrote to memory of 900	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	12
PID 4812 wrote to memory of 900	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	12
PID 4812 wrote to memory of 900	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	12
PID 4812 wrote to memory of 952	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	11
PID 4812 wrote to memory of 952	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	11
PID 4812 wrote to memory of 952	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	11
PID 4812 wrote to memory of 952	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	11
PID 4812 wrote to memory of 952	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	11
PID 4812 wrote to memory of 952	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	11
PID 4812 wrote to memory of 1016	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	10
PID 4812 wrote to memory of 1016	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	10
PID 4812 wrote to memory of 1016	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	10
PID 4812 wrote to memory of 1016	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	10
PID 4812 wrote to memory of 1016	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	10
PID 4812 wrote to memory of 1016	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	10
PID 4812 wrote to memory of 432	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	14
PID 4812 wrote to memory of 432	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	14
PID 4812 wrote to memory of 432	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	14
PID 4812 wrote to memory of 432	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	14
PID 4812 wrote to memory of 432	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	14
PID 4812 wrote to memory of 432	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	14
PID 4812 wrote to memory of 752	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	16
PID 4812 wrote to memory of 752	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	16
PID 4812 wrote to memory of 752	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	16
PID 4812 wrote to memory of 752	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	16
PID 4812 wrote to memory of 752	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	16
PID 4812 wrote to memory of 752	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	16
PID 4812 wrote to memory of 628	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	15
PID 4812 wrote to memory of 628	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	15
PID 4812 wrote to memory of 628	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	15
PID 4812 wrote to memory of 628	4812	28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe	15

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3640
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3484
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3992
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:644
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4680
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4264
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3796
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3552
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3488
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1152
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1916

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2644
- C:\Users\Admin\AppData\Local\Temp\28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe
  "C:\Users\Admin\AppData\Local\Temp\28da1f895909da7af9754a640414c68b5a788ffb87a96d48bdf6ef3078c59b2a.exe"
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1684
    3⤵
    - Program crash
    PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2652

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1884

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4812 -ip 4812
1⤵
PID:3184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4812-132-0x0000000001000000-0x000000000101A000-memory.dmp

Filesize
104KB

Download
memory/4812-133-0x0000000001000000-0x000000000101A000-memory.dmp

Filesize
104KB

Download