3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e

Analysis

max time kernel
75s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
Size

63KB
MD5

730bd5f04512983f404df9abd5955efb
SHA1

021a55183c9c3ecfbc058e09b0982dd994dd2fd8
SHA256

3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e
SHA512

a5ec39f4dc4182b91cfe06d9993aa662ae51364bd8008161e64aab59284b33af07a57845b7a2acbbe4849074dac424fa13db94e76a166d9d7d748a6fc735fbfe
SSDEEP

768:kOCPkgjITOsOuA0hc2Yyu7r/aZgeRlNMr1uuV8I3iihWjQEYI939OMhs2SCgVj:nCPtLL9eZgeRlmr58IytvYI9tZsVV

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe:*:enabled:@shell32.dll,-1"	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5008-132-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5008-134-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4580	5008	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 620	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	3
PID 5008 wrote to memory of 620	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	3
PID 5008 wrote to memory of 620	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	3
PID 5008 wrote to memory of 620	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	3
PID 5008 wrote to memory of 620	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	3
PID 5008 wrote to memory of 620	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	3
PID 5008 wrote to memory of 672	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	1
PID 5008 wrote to memory of 672	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	1
PID 5008 wrote to memory of 672	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	1
PID 5008 wrote to memory of 672	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	1
PID 5008 wrote to memory of 672	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	1
PID 5008 wrote to memory of 672	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	1
PID 5008 wrote to memory of 780	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	80
PID 5008 wrote to memory of 780	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	80
PID 5008 wrote to memory of 780	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	80
PID 5008 wrote to memory of 780	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	80
PID 5008 wrote to memory of 780	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	80
PID 5008 wrote to memory of 780	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	80
PID 5008 wrote to memory of 788	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	8
PID 5008 wrote to memory of 788	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	8
PID 5008 wrote to memory of 788	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	8
PID 5008 wrote to memory of 788	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	8
PID 5008 wrote to memory of 788	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	8
PID 5008 wrote to memory of 788	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	8
PID 5008 wrote to memory of 796	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	9
PID 5008 wrote to memory of 796	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	9
PID 5008 wrote to memory of 796	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	9
PID 5008 wrote to memory of 796	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	9
PID 5008 wrote to memory of 796	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	9
PID 5008 wrote to memory of 796	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	9
PID 5008 wrote to memory of 900	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	79
PID 5008 wrote to memory of 900	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	79
PID 5008 wrote to memory of 900	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	79
PID 5008 wrote to memory of 900	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	79
PID 5008 wrote to memory of 900	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	79
PID 5008 wrote to memory of 900	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	79
PID 5008 wrote to memory of 952	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	78
PID 5008 wrote to memory of 952	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	78
PID 5008 wrote to memory of 952	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	78
PID 5008 wrote to memory of 952	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	78
PID 5008 wrote to memory of 952	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	78
PID 5008 wrote to memory of 952	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	78
PID 5008 wrote to memory of 1016	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	10
PID 5008 wrote to memory of 1016	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	10
PID 5008 wrote to memory of 1016	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	10
PID 5008 wrote to memory of 1016	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	10
PID 5008 wrote to memory of 1016	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	10
PID 5008 wrote to memory of 1016	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	10
PID 5008 wrote to memory of 432	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	11
PID 5008 wrote to memory of 432	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	11
PID 5008 wrote to memory of 432	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	11
PID 5008 wrote to memory of 432	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	11
PID 5008 wrote to memory of 432	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	11
PID 5008 wrote to memory of 432	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	11
PID 5008 wrote to memory of 752	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	12
PID 5008 wrote to memory of 752	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	12
PID 5008 wrote to memory of 752	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	12
PID 5008 wrote to memory of 752	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	12
PID 5008 wrote to memory of 752	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	12
PID 5008 wrote to memory of 752	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	12
PID 5008 wrote to memory of 628	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	13
PID 5008 wrote to memory of 628	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	13
PID 5008 wrote to memory of 628	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	13
PID 5008 wrote to memory of 628	5008	3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe	13

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1152
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1384
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2216

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2720

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1976

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2644
- C:\Users\Admin\AppData\Local\Temp\3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe
  "C:\Users\Admin\AppData\Local\Temp\3f7815a83d46a1ec7949b61a16cb18fdb82e4059f4f83d19de58472b60ee010e.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 572
    3⤵
    - Program crash
    PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3188

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3384

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3552

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2256

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3992

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2292

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5112

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4680

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3796

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5008 -ip 5008
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5008-132-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5008-133-0x0000000000610000-0x0000000000614000-memory.dmp

Filesize
16KB

Download
memory/5008-134-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download