magniber | b9a5c8d73ddceea4dbc1ece8dbaf989d296a5a4932d2117f4c8aa9ed1e70e4ab

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2022 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9a5c8d73ddceea4dbc1ece8dbaf989d296a5a4932d2117f4c8aa9ed1e70e4ab.dll
Size

326KB
MD5

9cb5b0bec4a9172fe2299ebb0cc2be86
SHA1

8f5691556fbac1a36b99796b9d4e1683781c15a6
SHA256

b9a5c8d73ddceea4dbc1ece8dbaf989d296a5a4932d2117f4c8aa9ed1e70e4ab
SHA512

e1cf941610387e35364be8a860250c1b5c12cfccf7f276acd270a8fe1447b372125cdeb34e7247dee23fad81e3ddd30e7d53f08e59edab0b41859049fb23fc3f
SSDEEP

768:DAtuU+OABzXsm77CX3wQxdr1xh//nCyc5C2OGAlrYL:DAAUOBLwp3h//nCyc5rAlK

Score

10^/10

magniber evasion ransomware

Malware Config

Signatures

Detect magniber ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3208-132-0x0000025410CC0000-0x0000025410D10000-memory.dmp	family_magniber
behavioral2/memory/3208-133-0x0000025412D70000-0x0000025412D7B000-memory.dmp	family_magniber
behavioral2/memory/3564-134-0x00000250841D0000-0x00000250841D3000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 28 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

bcdedit.exebcdedit.exewbadmin.exewbadmin.exebcdedit.exebcdedit.exewbadmin.exewbadmin.exebcdedit.exewbadmin.exewbadmin.exewbadmin.exebcdedit.exebcdedit.exebcdedit.exewbadmin.exebcdedit.exewbadmin.exewbadmin.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exewbadmin.exewbadmin.exewbadmin.exewbadmin.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3892	bcdedit.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	3892	wbadmin.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	3892	wbadmin.exe	87

Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid	Process
1948	bcdedit.exe
3784	bcdedit.exe
3068	bcdedit.exe
4132	bcdedit.exe
3216	bcdedit.exe
4900	bcdedit.exe
2272	bcdedit.exe
3208	bcdedit.exe
268	bcdedit.exe
2208	bcdedit.exe
2384	bcdedit.exe
2764	bcdedit.exe
956	bcdedit.exe
4648	bcdedit.exe

Deletes System State backups 3 TTPs 7 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

wbadmin.exewbadmin.exewbadmin.exewbadmin.exewbadmin.exewbadmin.exewbadmin.exe

pid	Process
4012	wbadmin.exe
272	wbadmin.exe
2448	wbadmin.exe
4092	wbadmin.exe
1544	wbadmin.exe
5044	wbadmin.exe
2124	wbadmin.exe

Deletes backup catalog 3 TTPs 7 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

wbadmin.exewbadmin.exewbadmin.exewbadmin.exewbadmin.exewbadmin.exewbadmin.exe

pid	Process
1476	wbadmin.exe
2452	wbadmin.exe
1300	wbadmin.exe
4836	wbadmin.exe
4100	wbadmin.exe
4684	wbadmin.exe
4508	wbadmin.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

RuntimeBroker.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\DismountEnter.crw => C:\Users\Admin\Pictures\DismountEnter.crw.gogpjoms	RuntimeBroker.exe
File renamed	C:\Users\Admin\Pictures\SendExport.raw => C:\Users\Admin\Pictures\SendExport.raw.gogpjoms	RuntimeBroker.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4472	3344	WerFault.exe	44

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exefodhelper.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exefodhelper.exefodhelper.exeregsvr32.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	fodhelper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\xk8gwvc0j48a"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\xk8gwvc0j48a"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\xk8gwvc0j48a"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\ = "hstv3"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\ = "hstv3"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\ = "hstv3"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer\ = "hstv3"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\ms-settings\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\xk8gwvc0j48a"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\hstv3\Shell\Open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\xk8gwvc0j48a"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid	Process
3208	rundll32.exe
3208	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Explorer.EXEtaskhostw.exe

pid	Process
2824	Explorer.EXE
2420	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEcmd.exe

description	pid	Process
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeTakeOwnershipPrivilege	2972	cmd.exe
Token: SeRestorePrivilege	2972	cmd.exe
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE
Token: SeShutdownPrivilege	2824	Explorer.EXE
Token: SeCreatePagefilePrivilege	2824	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exefodhelper.execmd.execmd.execmd.exefodhelper.exefodhelper.exefodhelper.execmd.execmd.execmd.execmd.exefodhelper.exefodhelper.exefodhelper.exe

description	pid	Process	procid_target
PID 3208 wrote to memory of 2320	3208	rundll32.exe	18
PID 3208 wrote to memory of 2352	3208	rundll32.exe	55
PID 3208 wrote to memory of 2420	3208	rundll32.exe	54
PID 3208 wrote to memory of 2824	3208	rundll32.exe	46
PID 3208 wrote to memory of 3140	3208	rundll32.exe	45
PID 3208 wrote to memory of 3344	3208	rundll32.exe	44
PID 3208 wrote to memory of 3444	3208	rundll32.exe	21
PID 3208 wrote to memory of 3564	3208	rundll32.exe	22
PID 3208 wrote to memory of 3664	3208	rundll32.exe	42
PID 3208 wrote to memory of 3876	3208	rundll32.exe	41
PID 3208 wrote to memory of 4784	3208	rundll32.exe	39
PID 3208 wrote to memory of 2820	3208	rundll32.exe	27
PID 3208 wrote to memory of 4980	3208	rundll32.exe	25
PID 64 wrote to memory of 1748	64	cmd.exe	94
PID 64 wrote to memory of 1748	64	cmd.exe	94
PID 4360 wrote to memory of 1448	4360	cmd.exe	102
PID 4360 wrote to memory of 1448	4360	cmd.exe	102
PID 4036 wrote to memory of 3424	4036	cmd.exe	103
PID 4036 wrote to memory of 3424	4036	cmd.exe	103
PID 2428 wrote to memory of 4860	2428	cmd.exe	104
PID 2428 wrote to memory of 4860	2428	cmd.exe	104
PID 4864 wrote to memory of 1440	4864	cmd.exe	109
PID 4864 wrote to memory of 1440	4864	cmd.exe	109
PID 5116 wrote to memory of 4480	5116	cmd.exe	110
PID 5116 wrote to memory of 4480	5116	cmd.exe	110
PID 4936 wrote to memory of 4176	4936	cmd.exe	115
PID 4936 wrote to memory of 4176	4936	cmd.exe	115
PID 2972 wrote to memory of 5024	2972	cmd.exe	116
PID 2972 wrote to memory of 5024	2972	cmd.exe	116
PID 2972 wrote to memory of 5024	2972	cmd.exe	116
PID 2836 wrote to memory of 1300	2836	cmd.exe	123
PID 2836 wrote to memory of 1300	2836	cmd.exe	123
PID 4740 wrote to memory of 4916	4740	cmd.exe	124
PID 4740 wrote to memory of 4916	4740	cmd.exe	124
PID 4104 wrote to memory of 4956	4104	cmd.exe	125
PID 4104 wrote to memory of 4956	4104	cmd.exe	125
PID 4956 wrote to memory of 4296	4956	fodhelper.exe	127
PID 4956 wrote to memory of 4296	4956	fodhelper.exe	127
PID 1468 wrote to memory of 4972	1468	cmd.exe	148
PID 1468 wrote to memory of 4972	1468	cmd.exe	148
PID 1072 wrote to memory of 5068	1072	cmd.exe	149
PID 1072 wrote to memory of 5068	1072	cmd.exe	149
PID 1840 wrote to memory of 2368	1840	cmd.exe	150
PID 1840 wrote to memory of 2368	1840	cmd.exe	150
PID 4972 wrote to memory of 4540	4972	fodhelper.exe	151
PID 4972 wrote to memory of 4540	4972	fodhelper.exe	151
PID 2368 wrote to memory of 2436	2368	fodhelper.exe	196
PID 2368 wrote to memory of 2436	2368	fodhelper.exe	196
PID 5068 wrote to memory of 2056	5068	fodhelper.exe	153
PID 5068 wrote to memory of 2056	5068	fodhelper.exe	153
PID 2228 wrote to memory of 2032	2228	cmd.exe	185
PID 2228 wrote to memory of 2032	2228	cmd.exe	185
PID 4904 wrote to memory of 3032	4904	cmd.exe	187
PID 4904 wrote to memory of 3032	4904	cmd.exe	187
PID 4088 wrote to memory of 3200	4088	cmd.exe	188
PID 4088 wrote to memory of 3200	4088	cmd.exe	188
PID 2152 wrote to memory of 3864	2152	cmd.exe	189
PID 2152 wrote to memory of 3864	2152	cmd.exe	189
PID 2152 wrote to memory of 3864	2152	cmd.exe	189
PID 2032 wrote to memory of 2528	2032	fodhelper.exe	190
PID 2032 wrote to memory of 2528	2032	fodhelper.exe	190
PID 3032 wrote to memory of 3936	3032	fodhelper.exe	191
PID 3032 wrote to memory of 3936	3032	fodhelper.exe	191
PID 3200 wrote to memory of 4176	3200	fodhelper.exe	192

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2320
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:1448
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:2056

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3444
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    PID:5024
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Modifies registry class
    PID:3864

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies extensions of user files
PID:3564
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:1748
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:4296

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4980
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:4480
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:3936

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2820

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4784
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:4860
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:2436

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3876
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:4916
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  PID:1392
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Modifies registry class
    PID:3100
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:4656

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3664

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3344
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3344 -s 848
  2⤵
  - Program crash
  PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3140
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:1440
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:2528

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2824
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9a5c8d73ddceea4dbc1ece8dbaf989d296a5a4932d2117f4c8aa9ed1e70e4ab.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3208
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:4176
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:4176

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2420
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:1300
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  PID:1080
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:4956
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2352
- C:\Windows\System32\cmd.exe
  /c regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:C:\Users\Public\w0d962q97m27
    3⤵
    - Modifies registry class
    PID:3424
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:C:\Users\Public\xk8gwvc0j48a
      4⤵
      PID:4540

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3344 -ip 3344
1⤵
PID:4924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4584

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:1948

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:3784

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:1476

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
PID:4012

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1316

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4084

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:3068

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:4132

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:2452

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:1300

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:3216

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:4836

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
PID:272

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
PID:2448

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:4900

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:2272

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:3208

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
PID:4092

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:268

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2436

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
PID:1544

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:4100

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:2208

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:2384

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:2764

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:956

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:4648

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
PID:5044

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:4684

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
PID:2124

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:4508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\w0d962q97m27

Filesize
8KB

MD5
2d5bc9f318802eb8380ffc81f319e528

SHA1
95718cd9a3bd94b10c83432975e1b1b100bcf16c

SHA256
1ed94ba44a6d98877e0b68525d78e82b2bef3a09ffa6faa66d50c702716b2cdc

SHA512
8035220876de69df914e3fcdc52bd426b46d4ad231e341b659ae88f6ada1c9188ee9c7b44ae2c4fe90d981ab106bd7d6d17be121fbf36f06ff2092870619d580

Download Submit
C:\Users\Public\xk8gwvc0j48a

Filesize
1002B

MD5
929d1d83affd9505918faef8d2e390b8

SHA1
7bc39642e5fa4ba0871c13c187a57078570cb0cb

SHA256
ae5a72961535caee9d0ce7e3082a242f9fb3ed5c2897125da2ebb1fe08b56c6a

SHA512
6addeb2a33898617ee954d7bc2ee12e9fb677a19e1b198a609c308066236cd0c94344d432bf083cf6ae5a82555b07c00681ed578274711e27642c9b054c84167

Download Submit
C:\Users\Public\xk8gwvc0j48a

Filesize
1002B

MD5
929d1d83affd9505918faef8d2e390b8

SHA1
7bc39642e5fa4ba0871c13c187a57078570cb0cb

SHA256
ae5a72961535caee9d0ce7e3082a242f9fb3ed5c2897125da2ebb1fe08b56c6a

SHA512
6addeb2a33898617ee954d7bc2ee12e9fb677a19e1b198a609c308066236cd0c94344d432bf083cf6ae5a82555b07c00681ed578274711e27642c9b054c84167

Download Submit
C:\Users\Public\xk8gwvc0j48a

Filesize
1002B

MD5
929d1d83affd9505918faef8d2e390b8

SHA1
7bc39642e5fa4ba0871c13c187a57078570cb0cb

SHA256
ae5a72961535caee9d0ce7e3082a242f9fb3ed5c2897125da2ebb1fe08b56c6a

SHA512
6addeb2a33898617ee954d7bc2ee12e9fb677a19e1b198a609c308066236cd0c94344d432bf083cf6ae5a82555b07c00681ed578274711e27642c9b054c84167

Download Submit
C:\Users\Public\xk8gwvc0j48a

Filesize
1002B

MD5
929d1d83affd9505918faef8d2e390b8

SHA1
7bc39642e5fa4ba0871c13c187a57078570cb0cb

SHA256
ae5a72961535caee9d0ce7e3082a242f9fb3ed5c2897125da2ebb1fe08b56c6a

SHA512
6addeb2a33898617ee954d7bc2ee12e9fb677a19e1b198a609c308066236cd0c94344d432bf083cf6ae5a82555b07c00681ed578274711e27642c9b054c84167

Download Submit
C:\Users\Public\xk8gwvc0j48a

Filesize
1002B

MD5
929d1d83affd9505918faef8d2e390b8

SHA1
7bc39642e5fa4ba0871c13c187a57078570cb0cb

SHA256
ae5a72961535caee9d0ce7e3082a242f9fb3ed5c2897125da2ebb1fe08b56c6a

SHA512
6addeb2a33898617ee954d7bc2ee12e9fb677a19e1b198a609c308066236cd0c94344d432bf083cf6ae5a82555b07c00681ed578274711e27642c9b054c84167

Download Submit
C:\Users\Public\xk8gwvc0j48a

Filesize
1002B

MD5
929d1d83affd9505918faef8d2e390b8

SHA1
7bc39642e5fa4ba0871c13c187a57078570cb0cb

SHA256
ae5a72961535caee9d0ce7e3082a242f9fb3ed5c2897125da2ebb1fe08b56c6a

SHA512
6addeb2a33898617ee954d7bc2ee12e9fb677a19e1b198a609c308066236cd0c94344d432bf083cf6ae5a82555b07c00681ed578274711e27642c9b054c84167

Download Submit
C:\Users\Public\xk8gwvc0j48a

Filesize
1002B

MD5
929d1d83affd9505918faef8d2e390b8

SHA1
7bc39642e5fa4ba0871c13c187a57078570cb0cb

SHA256
ae5a72961535caee9d0ce7e3082a242f9fb3ed5c2897125da2ebb1fe08b56c6a

SHA512
6addeb2a33898617ee954d7bc2ee12e9fb677a19e1b198a609c308066236cd0c94344d432bf083cf6ae5a82555b07c00681ed578274711e27642c9b054c84167

Download Submit
C:\Users\Public\xk8gwvc0j48a

Filesize
1002B

MD5
929d1d83affd9505918faef8d2e390b8

SHA1
7bc39642e5fa4ba0871c13c187a57078570cb0cb

SHA256
ae5a72961535caee9d0ce7e3082a242f9fb3ed5c2897125da2ebb1fe08b56c6a

SHA512
6addeb2a33898617ee954d7bc2ee12e9fb677a19e1b198a609c308066236cd0c94344d432bf083cf6ae5a82555b07c00681ed578274711e27642c9b054c84167

Download Submit
memory/1244-179-0x0000000000000000-mapping.dmp

Download
memory/1300-151-0x0000000000000000-mapping.dmp

Download
memory/1440-145-0x0000000000000000-mapping.dmp

Download
memory/1448-139-0x0000000000000000-mapping.dmp

Download
memory/1748-135-0x0000000000000000-mapping.dmp

Download
memory/2032-168-0x0000000000000000-mapping.dmp

Download
memory/2056-167-0x0000000000000000-mapping.dmp

Download
memory/2368-161-0x0000000000000000-mapping.dmp

Download
memory/2436-166-0x0000000000000000-mapping.dmp

Download
memory/2528-172-0x0000000000000000-mapping.dmp

Download
memory/3032-169-0x0000000000000000-mapping.dmp

Download
memory/3100-178-0x0000000000000000-mapping.dmp

Download
memory/3200-170-0x0000000000000000-mapping.dmp

Download
memory/3208-132-0x0000025410CC0000-0x0000025410D10000-memory.dmp

Filesize
320KB

Download
memory/3208-133-0x0000025412D70000-0x0000025412D7B000-memory.dmp

Filesize
44KB

Download
memory/3424-141-0x0000000000000000-mapping.dmp

Download
memory/3564-134-0x00000250841D0000-0x00000250841D3000-memory.dmp

Filesize
12KB

Download
memory/3864-171-0x0000000000000000-mapping.dmp

Download
memory/3936-174-0x0000000000000000-mapping.dmp

Download
memory/4176-175-0x0000000000000000-mapping.dmp

Download
memory/4176-148-0x0000000000000000-mapping.dmp

Download
memory/4296-155-0x0000000000000000-mapping.dmp

Download
memory/4480-147-0x0000000000000000-mapping.dmp

Download
memory/4540-164-0x0000000000000000-mapping.dmp

Download
memory/4656-180-0x0000000000000000-mapping.dmp

Download
memory/4860-142-0x0000000000000000-mapping.dmp

Download
memory/4916-153-0x0000000000000000-mapping.dmp

Download
memory/4956-154-0x0000000000000000-mapping.dmp

Download
memory/4956-177-0x0000000000000000-mapping.dmp

Download
memory/4972-159-0x0000000000000000-mapping.dmp

Download
memory/5024-149-0x0000000000000000-mapping.dmp

Download
memory/5068-160-0x0000000000000000-mapping.dmp

Download