55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
Size

69KB
MD5

801bd83233b9f6074b858d250e9168c0
SHA1

fc17c1cda5983c4e706ca6f0903509159123a5b7
SHA256

55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0
SHA512

a7eefd5e6db21c0dc8e91c957ba0728c42e354006a6e9576e05675d87e4663c713100acd5f00e63bb6c1927aafda5c628ebf80b4a0b96d348547f085eda6cf3b
SSDEEP

1536:qPi19163vNe7OK2FpYMkfG10ug6cQGKcHxhxrxNZun9g9wi+S0rl:qG163WOXFbcQGKcHxhxrxNwn9g9wpt5

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe:*:enabled:@shell32.dll,-1"	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 580	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	3
PID 4444 wrote to memory of 580	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	3
PID 4444 wrote to memory of 580	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	3
PID 4444 wrote to memory of 580	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	3
PID 4444 wrote to memory of 580	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	3
PID 4444 wrote to memory of 580	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	3
PID 4444 wrote to memory of 664	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	1
PID 4444 wrote to memory of 664	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	1
PID 4444 wrote to memory of 664	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	1
PID 4444 wrote to memory of 664	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	1
PID 4444 wrote to memory of 664	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	1
PID 4444 wrote to memory of 664	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	1
PID 4444 wrote to memory of 776	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	8
PID 4444 wrote to memory of 776	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	8
PID 4444 wrote to memory of 776	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	8
PID 4444 wrote to memory of 776	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	8
PID 4444 wrote to memory of 776	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	8
PID 4444 wrote to memory of 776	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	8
PID 4444 wrote to memory of 768	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	80
PID 4444 wrote to memory of 768	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	80
PID 4444 wrote to memory of 768	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	80
PID 4444 wrote to memory of 768	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	80
PID 4444 wrote to memory of 768	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	80
PID 4444 wrote to memory of 768	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	80
PID 4444 wrote to memory of 784	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	79
PID 4444 wrote to memory of 784	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	79
PID 4444 wrote to memory of 784	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	79
PID 4444 wrote to memory of 784	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	79
PID 4444 wrote to memory of 784	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	79
PID 4444 wrote to memory of 784	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	79
PID 4444 wrote to memory of 880	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	78
PID 4444 wrote to memory of 880	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	78
PID 4444 wrote to memory of 880	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	78
PID 4444 wrote to memory of 880	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	78
PID 4444 wrote to memory of 880	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	78
PID 4444 wrote to memory of 880	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	78
PID 4444 wrote to memory of 936	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	9
PID 4444 wrote to memory of 936	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	9
PID 4444 wrote to memory of 936	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	9
PID 4444 wrote to memory of 936	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	9
PID 4444 wrote to memory of 936	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	9
PID 4444 wrote to memory of 936	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	9
PID 4444 wrote to memory of 1020	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	10
PID 4444 wrote to memory of 1020	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	10
PID 4444 wrote to memory of 1020	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	10
PID 4444 wrote to memory of 1020	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	10
PID 4444 wrote to memory of 1020	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	10
PID 4444 wrote to memory of 1020	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	10
PID 4444 wrote to memory of 428	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	77
PID 4444 wrote to memory of 428	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	77
PID 4444 wrote to memory of 428	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	77
PID 4444 wrote to memory of 428	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	77
PID 4444 wrote to memory of 428	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	77
PID 4444 wrote to memory of 428	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	77
PID 4444 wrote to memory of 672	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	11
PID 4444 wrote to memory of 672	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	11
PID 4444 wrote to memory of 672	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	11
PID 4444 wrote to memory of 672	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	11
PID 4444 wrote to memory of 672	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	11
PID 4444 wrote to memory of 672	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	11
PID 4444 wrote to memory of 984	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	76
PID 4444 wrote to memory of 984	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	76
PID 4444 wrote to memory of 984	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	76
PID 4444 wrote to memory of 984	4444	55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe	76

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:580
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2332

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2768

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3344

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3412

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3496

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2720
- C:\Users\Admin\AppData\Local\Temp\55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe
  "C:\Users\Admin\AppData\Local\Temp\55a142b63cb92be3104ad9c1e2a3819b949add829ad13428fb39a3e41186d7f0.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5052

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2920

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4500

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1868

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:3932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4124

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4560

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2584

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2468

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2092

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4444-132-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download
memory/4444-133-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download