60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d

Analysis

max time kernel
173s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
Size

360KB
MD5

7c93c64b616ef9b4799ac4cb226d00c3
SHA1

b227aa48be16c21c94da5cc20e88d4e6ff0c1393
SHA256

60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d
SHA512

5716b68d37832ad307d49d44491099d5e08cd7bcd7d2eb6a0310b33a78bcd9184020f91bd9b8b916fe3a9b69b5d6ecbd5e0fe9650843e1455b7b27c08e7c72af
SSDEEP

6144:3ZkykQRjhViHamAOxUCHyLSq8dkbpxIXPIlIFXn8C4:3ZkyrjhViHHxnSyKwPYIF6

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe:*:enabled:@shell32.dll,-1"	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe

Executes dropped EXE 3 IoCs

pid	Process
4216	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgr.exe
4504	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe
1692	WaterMark.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/392-132-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/4216-145-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4216-149-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4216-151-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4504-152-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4504-153-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4216-154-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4504-155-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4504-160-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1692-162-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/1692-164-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/1692-166-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/1692-170-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/392-171-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/4216-172-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4216-174-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4216-175-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4216-176-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/1692-177-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/1692-178-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/1692-179-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/1692-180-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/1692-181-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4216-182-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/392-186-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px5525.tmp	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px5526.tmp	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgr.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
488	4216	WerFault.exe	80
3640	4000	WerFault.exe	87
1592	392	WerFault.exe	79

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989874"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30989874"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{666AB1EF-4A25-11ED-89AC-EE6CABA3804C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1037289776"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372341019"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{666A8ADF-4A25-11ED-89AC-EE6CABA3804C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1037289776"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe
1692	WaterMark.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
Token: SeDebugPrivilege	1692	WaterMark.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3196	iexplore.exe
4976	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
4976	iexplore.exe
4976	iexplore.exe
3196	iexplore.exe
3196	iexplore.exe
4724	IEXPLORE.EXE
4724	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
4216	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgr.exe
4504	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe
1692	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4216	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	80
PID 392 wrote to memory of 4216	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	80
PID 392 wrote to memory of 4216	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	80
PID 392 wrote to memory of 616	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	4
PID 392 wrote to memory of 616	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	4
PID 392 wrote to memory of 616	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	4
PID 392 wrote to memory of 616	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	4
PID 392 wrote to memory of 616	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	4
PID 392 wrote to memory of 616	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	4
PID 392 wrote to memory of 672	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	2
PID 392 wrote to memory of 672	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	2
PID 392 wrote to memory of 672	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	2
PID 392 wrote to memory of 672	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	2
PID 392 wrote to memory of 672	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	2
PID 392 wrote to memory of 672	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	2
PID 392 wrote to memory of 784	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	8
PID 392 wrote to memory of 784	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	8
PID 392 wrote to memory of 784	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	8
PID 392 wrote to memory of 784	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	8
PID 392 wrote to memory of 784	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	8
PID 392 wrote to memory of 784	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	8
PID 392 wrote to memory of 796	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	9
PID 392 wrote to memory of 796	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	9
PID 392 wrote to memory of 796	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	9
PID 392 wrote to memory of 796	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	9
PID 392 wrote to memory of 796	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	9
PID 392 wrote to memory of 796	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	9
PID 392 wrote to memory of 804	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	24
PID 392 wrote to memory of 804	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	24
PID 392 wrote to memory of 804	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	24
PID 392 wrote to memory of 804	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	24
PID 392 wrote to memory of 804	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	24
PID 392 wrote to memory of 804	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	24
PID 392 wrote to memory of 908	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	23
PID 392 wrote to memory of 908	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	23
PID 392 wrote to memory of 908	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	23
PID 392 wrote to memory of 908	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	23
PID 392 wrote to memory of 908	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	23
PID 392 wrote to memory of 908	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	23
PID 392 wrote to memory of 956	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	21
PID 392 wrote to memory of 956	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	21
PID 392 wrote to memory of 956	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	21
PID 392 wrote to memory of 956	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	21
PID 392 wrote to memory of 956	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	21
PID 392 wrote to memory of 956	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	21
PID 392 wrote to memory of 312	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	11
PID 392 wrote to memory of 312	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	11
PID 392 wrote to memory of 312	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	11
PID 392 wrote to memory of 312	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	11
PID 392 wrote to memory of 312	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	11
PID 392 wrote to memory of 312	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	11
PID 392 wrote to memory of 484	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	10
PID 392 wrote to memory of 484	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	10
PID 392 wrote to memory of 484	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	10
PID 392 wrote to memory of 484	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	10
PID 392 wrote to memory of 484	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	10
PID 392 wrote to memory of 484	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	10
PID 392 wrote to memory of 724	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	12
PID 392 wrote to memory of 724	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	12
PID 392 wrote to memory of 724	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	12
PID 392 wrote to memory of 724	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	12
PID 392 wrote to memory of 724	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	12
PID 392 wrote to memory of 724	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	12
PID 392 wrote to memory of 924	392	60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe	19

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:796
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3368
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3272
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3440
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3532
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3660
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4412
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4624
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1564
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3860
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1484
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1968

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2456

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2684

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2832
- C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe
  "C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69d.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgr.exe
    C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of UnmapMainImage
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe
      C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of UnmapMainImage
      PID:4504
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        
        PID:1692
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 204
        7⤵
        Program crash
        
        PID:3640
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4976
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4976 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1884
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3196
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3196 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 304
      4⤵
      Program crash
      PID:488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 1264
    3⤵
    - Program crash
    PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4216 -ip 4216
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4000 -ip 4000
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 392 -ip 392
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
92KB

MD5
182e2e19ca5e79941fb2add9ef7a0cee

SHA1
e6eb18b0358514bad3172307dfc9a6524587cb23

SHA256
8416706fa0f322ff2e7464e12c58096117f31675131d023792dd16800d1cc384

SHA512
7e9852764e0726a0816f9f66bef88391c21df49c3d2b329d4f70eb95b3bf9d1eb62294c3c92249c5e5da1a6f6534852129a7dedef01dfae19d05c4ee3b20db3d

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
92KB

MD5
182e2e19ca5e79941fb2add9ef7a0cee

SHA1
e6eb18b0358514bad3172307dfc9a6524587cb23

SHA256
8416706fa0f322ff2e7464e12c58096117f31675131d023792dd16800d1cc384

SHA512
7e9852764e0726a0816f9f66bef88391c21df49c3d2b329d4f70eb95b3bf9d1eb62294c3c92249c5e5da1a6f6534852129a7dedef01dfae19d05c4ee3b20db3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{666A8ADF-4A25-11ED-89AC-EE6CABA3804C}.dat

Filesize
3KB

MD5
095e8027f15a91be4868d9c24a5c4f84

SHA1
39c4cf76cea46514d66477c8f332de7131389af1

SHA256
a41889bb7c07c831ea503d05abd04c39e8d2c94b272b1af54a4d73e9aeec0b4f

SHA512
20967a8d6cfaec56052f32085171463caaf4edeb2ef313955fa99f32433d5a50f349b4d1b5a482fb63de26fb5c9aba670ba4233d721fd703d5cbfb89ca84c6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{666AB1EF-4A25-11ED-89AC-EE6CABA3804C}.dat

Filesize
3KB

MD5
7624a6938ece6dc5196c1a0139fed88d

SHA1
982c6b56f50d1481a2800f9c051959f3e63a1258

SHA256
6a64ec23b2624ad23646d6e340d8c24427829ababbd98b5b6b5a467f207861dd

SHA512
080c05db3c383b84f3bee4be48f921bbb810925182471e7b29fa9ca03c57a84143316b745b2e4a80527fe9da8962a86b3deefa6a4bdc64f08f90d37442db2b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgr.exe

Filesize
234KB

MD5
c73f8db0051d910256c159e01ff83809

SHA1
4acdf9d84ae0a783448c55da4d91a25845ca4ada

SHA256
b739c0110bc5258318b13cff88d5ca27d3a46727d40d4a3d5422c6e908b0f636

SHA512
f6b1d4e2b0a39573459051be8e3cedd896d03d4280bf423ff8302074e6a26f3d23903da59150c315971eb41fd0e1527bcff6242acba3165f7abc8d8ce35dba97

Download Submit
C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgr.exe

Filesize
234KB

MD5
c73f8db0051d910256c159e01ff83809

SHA1
4acdf9d84ae0a783448c55da4d91a25845ca4ada

SHA256
b739c0110bc5258318b13cff88d5ca27d3a46727d40d4a3d5422c6e908b0f636

SHA512
f6b1d4e2b0a39573459051be8e3cedd896d03d4280bf423ff8302074e6a26f3d23903da59150c315971eb41fd0e1527bcff6242acba3165f7abc8d8ce35dba97

Download Submit
C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe

Filesize
92KB

MD5
182e2e19ca5e79941fb2add9ef7a0cee

SHA1
e6eb18b0358514bad3172307dfc9a6524587cb23

SHA256
8416706fa0f322ff2e7464e12c58096117f31675131d023792dd16800d1cc384

SHA512
7e9852764e0726a0816f9f66bef88391c21df49c3d2b329d4f70eb95b3bf9d1eb62294c3c92249c5e5da1a6f6534852129a7dedef01dfae19d05c4ee3b20db3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\60bdf67aa7e1f6f217d7039fd43a47fc84db18dec467e0ce4feefa675965a69dmgrmgr.exe

Filesize
92KB

MD5
182e2e19ca5e79941fb2add9ef7a0cee

SHA1
e6eb18b0358514bad3172307dfc9a6524587cb23

SHA256
8416706fa0f322ff2e7464e12c58096117f31675131d023792dd16800d1cc384

SHA512
7e9852764e0726a0816f9f66bef88391c21df49c3d2b329d4f70eb95b3bf9d1eb62294c3c92249c5e5da1a6f6534852129a7dedef01dfae19d05c4ee3b20db3d

Download Submit
memory/392-132-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/392-186-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/392-171-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1692-179-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1692-177-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1692-178-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1692-164-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1692-170-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1692-180-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1692-181-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1692-166-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1692-162-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4216-175-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4216-176-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4216-154-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4216-138-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4216-172-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4216-173-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4216-174-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4216-183-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4216-182-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4216-151-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4216-149-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4216-145-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4216-139-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4504-140-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4504-160-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4504-152-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4504-153-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4504-155-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download