87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
Size

152KB
MD5

0cbc7382b8a367d6bddf274053d8aae0
SHA1

5af0b58ee79a568ed126ada69cb2f8897b7f7f39
SHA256

87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252
SHA512

63a601172536efd40dc24ca656b628305a4e6275f5546310ee7f4e006f2e6fb396468d44b1b5a34ec19ec9897686112195d4da98bac7423ca821bec825f0571f
SSDEEP

1536:PpszV5YtowhRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUm6wTIDUdBiDSgi:hGzYKwhkFoN3Oo1+FvfSLIQdBiWgi

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe:*:enabled:@shell32.dll,-1"	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2196	4636	WerFault.exe	63
1944	4636	WerFault.exe	63

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 588	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	6
PID 4636 wrote to memory of 588	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	6
PID 4636 wrote to memory of 588	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	6
PID 4636 wrote to memory of 588	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	6
PID 4636 wrote to memory of 588	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	6
PID 4636 wrote to memory of 588	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	6
PID 4636 wrote to memory of 672	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	4
PID 4636 wrote to memory of 672	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	4
PID 4636 wrote to memory of 672	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	4
PID 4636 wrote to memory of 672	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	4
PID 4636 wrote to memory of 672	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	4
PID 4636 wrote to memory of 672	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	4
PID 4636 wrote to memory of 772	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	13
PID 4636 wrote to memory of 772	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	13
PID 4636 wrote to memory of 772	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	13
PID 4636 wrote to memory of 772	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	13
PID 4636 wrote to memory of 772	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	13
PID 4636 wrote to memory of 772	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	13
PID 4636 wrote to memory of 780	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	8
PID 4636 wrote to memory of 780	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	8
PID 4636 wrote to memory of 780	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	8
PID 4636 wrote to memory of 780	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	8
PID 4636 wrote to memory of 780	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	8
PID 4636 wrote to memory of 780	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	8
PID 4636 wrote to memory of 788	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	12
PID 4636 wrote to memory of 788	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	12
PID 4636 wrote to memory of 788	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	12
PID 4636 wrote to memory of 788	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	12
PID 4636 wrote to memory of 788	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	12
PID 4636 wrote to memory of 788	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	12
PID 4636 wrote to memory of 888	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	11
PID 4636 wrote to memory of 888	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	11
PID 4636 wrote to memory of 888	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	11
PID 4636 wrote to memory of 888	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	11
PID 4636 wrote to memory of 888	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	11
PID 4636 wrote to memory of 888	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	11
PID 4636 wrote to memory of 940	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	10
PID 4636 wrote to memory of 940	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	10
PID 4636 wrote to memory of 940	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	10
PID 4636 wrote to memory of 940	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	10
PID 4636 wrote to memory of 940	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	10
PID 4636 wrote to memory of 940	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	10
PID 4636 wrote to memory of 1016	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	9
PID 4636 wrote to memory of 1016	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	9
PID 4636 wrote to memory of 1016	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	9
PID 4636 wrote to memory of 1016	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	9
PID 4636 wrote to memory of 1016	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	9
PID 4636 wrote to memory of 1016	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	9
PID 4636 wrote to memory of 484	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	14
PID 4636 wrote to memory of 484	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	14
PID 4636 wrote to memory of 484	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	14
PID 4636 wrote to memory of 484	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	14
PID 4636 wrote to memory of 484	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	14
PID 4636 wrote to memory of 484	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	14
PID 4636 wrote to memory of 424	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	15
PID 4636 wrote to memory of 424	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	15
PID 4636 wrote to memory of 424	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	15
PID 4636 wrote to memory of 424	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	15
PID 4636 wrote to memory of 424	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	15
PID 4636 wrote to memory of 424	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	15
PID 4636 wrote to memory of 904	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	19
PID 4636 wrote to memory of 904	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	19
PID 4636 wrote to memory of 904	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	19
PID 4636 wrote to memory of 904	4636	87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe	19

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:888

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3292
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4796
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4396
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:3344
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4852
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3888
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3608
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3524
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3444
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3376
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1124
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2724
- C:\Users\Admin\AppData\Local\Temp\87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe
  "C:\Users\Admin\AppData\Local\Temp\87b2901bc9ebeaed11f7b212c15b6864ef73c0c880e6981c08b3e0e447e39252.exe"
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1888
    3⤵
    - Program crash
    PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1888
    3⤵
    - Program crash
    PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2616

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2376

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4636 -ip 4636
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4636 -ip 4636
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4636-135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download