0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8

Analysis

max time kernel
112s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
Size

193KB
MD5

761c964357ce1eaee282a8ac98c57040
SHA1

951a40fdfaf9d21042616481fcf9790c86bc6437
SHA256

0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8
SHA512

e166e3969c555b03de7a2f08f91d00d9d89a861f43a4be4313f05ef591574edc1b0b6973b73cc2d2130c4e138ca11f28a400587bef9ad44d5526c8f38812170a
SSDEEP

3072:c4SAR89q06DTeR8o3Ci/c5LuZjAV+Hv44SAR8NH06DT:czAinN/c5LuZAzASU

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe:*:enabled:@shell32.dll,-1"	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4728	1664	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 588	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	4
PID 1664 wrote to memory of 588	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	4
PID 1664 wrote to memory of 588	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	4
PID 1664 wrote to memory of 588	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	4
PID 1664 wrote to memory of 588	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	4
PID 1664 wrote to memory of 588	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	4
PID 1664 wrote to memory of 664	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	2
PID 1664 wrote to memory of 664	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	2
PID 1664 wrote to memory of 664	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	2
PID 1664 wrote to memory of 664	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	2
PID 1664 wrote to memory of 664	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	2
PID 1664 wrote to memory of 664	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	2
PID 1664 wrote to memory of 772	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	8
PID 1664 wrote to memory of 772	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	8
PID 1664 wrote to memory of 772	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	8
PID 1664 wrote to memory of 772	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	8
PID 1664 wrote to memory of 772	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	8
PID 1664 wrote to memory of 772	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	8
PID 1664 wrote to memory of 776	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	81
PID 1664 wrote to memory of 776	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	81
PID 1664 wrote to memory of 776	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	81
PID 1664 wrote to memory of 776	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	81
PID 1664 wrote to memory of 776	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	81
PID 1664 wrote to memory of 776	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	81
PID 1664 wrote to memory of 788	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	80
PID 1664 wrote to memory of 788	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	80
PID 1664 wrote to memory of 788	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	80
PID 1664 wrote to memory of 788	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	80
PID 1664 wrote to memory of 788	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	80
PID 1664 wrote to memory of 788	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	80
PID 1664 wrote to memory of 900	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	79
PID 1664 wrote to memory of 900	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	79
PID 1664 wrote to memory of 900	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	79
PID 1664 wrote to memory of 900	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	79
PID 1664 wrote to memory of 900	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	79
PID 1664 wrote to memory of 900	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	79
PID 1664 wrote to memory of 952	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	78
PID 1664 wrote to memory of 952	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	78
PID 1664 wrote to memory of 952	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	78
PID 1664 wrote to memory of 952	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	78
PID 1664 wrote to memory of 952	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	78
PID 1664 wrote to memory of 952	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	78
PID 1664 wrote to memory of 328	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	9
PID 1664 wrote to memory of 328	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	9
PID 1664 wrote to memory of 328	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	9
PID 1664 wrote to memory of 328	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	9
PID 1664 wrote to memory of 328	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	9
PID 1664 wrote to memory of 328	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	9
PID 1664 wrote to memory of 444	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	10
PID 1664 wrote to memory of 444	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	10
PID 1664 wrote to memory of 444	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	10
PID 1664 wrote to memory of 444	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	10
PID 1664 wrote to memory of 444	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	10
PID 1664 wrote to memory of 444	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	10
PID 1664 wrote to memory of 408	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	76
PID 1664 wrote to memory of 408	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	76
PID 1664 wrote to memory of 408	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	76
PID 1664 wrote to memory of 408	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	76
PID 1664 wrote to memory of 408	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	76
PID 1664 wrote to memory of 408	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	76
PID 1664 wrote to memory of 860	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	75
PID 1664 wrote to memory of 860	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	75
PID 1664 wrote to memory of 860	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	75
PID 1664 wrote to memory of 860	1664	0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe	75

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:328
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2068

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1664 -ip 1664
  2⤵
  PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1896

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1448

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5060

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4612

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4360

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3680

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3544

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3384

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:652
- C:\Users\Admin\AppData\Local\Temp\0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe
  "C:\Users\Admin\AppData\Local\Temp\0c707d01232a3249cd1f7cf767e93f2a022f35b440435869c52bd295ae33b6c8.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 1044
    3⤵
    - Program crash
    PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2824

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2576

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2480

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1664-133-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download