fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e

Analysis

max time kernel
151s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
Size

46KB
MD5

09dc0c40e288bc6f914b4915e3cc6910
SHA1

0119ee3a7345f7c0566fe0ec55d41f3d4c58228e
SHA256

fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e
SHA512

d1960cf2314083d599acb52c76f94bd7fce5e6117c5dbf01d8f0f9ca42fcc78fb66932dee703f245941741de0dd538373e8d1dd4b46793c2c0fc714a4fb54487
SSDEEP

768:BJzJB5Komz8DdPaDfijlSqnHPk1kz8+Xk62nvodahZGvDHSOXqS:BJFBTmDriTn8SwMkXodJN/

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe:*:enabled:@shell32.dll,-1"	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "223"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
2788	Process not Found
388	Process not Found
520	Process not Found
364	Process not Found
1656	Process not Found
3216	Process not Found
3852	Process not Found
4440	Process not Found
1100	Process not Found
2952	Process not Found
648	Process not Found
3504	Process not Found
32	Process not Found
228	Process not Found
204	Process not Found
4328	Process not Found
3692	Process not Found
4128	Process not Found
3120	Process not Found
4204	Process not Found
1444	Process not Found
4280	Process not Found
3304	Process not Found
4300	Process not Found
4320	Process not Found
4104	Process not Found
4504	Process not Found
4244	Process not Found
4852	Process not Found
4420	Process not Found
1188	Process not Found
1812	Process not Found
4640	Process not Found
4228	Process not Found
4892	Process not Found
3196	Process not Found
2732	Process not Found
4544	Process not Found
5052	Process not Found
3952	Process not Found
1332	Process not Found
4356	Process not Found
3380	Process not Found
3992	Process not Found
2836	Process not Found
3508	Process not Found
4568	Process not Found
3616	Process not Found
2720	Process not Found
3872	Process not Found
4180	Process not Found
1288	Process not Found
4184	Process not Found
4560	Process not Found
5084	Process not Found
4916	Process not Found
4668	Process not Found
3620	Process not Found
3832	Process not Found
1904	Process not Found
3796	Process not Found
4256	Process not Found
4736	Process not Found
2044	Process not Found

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 584	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	76
PID 4964 wrote to memory of 584	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	76
PID 4964 wrote to memory of 584	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	76
PID 4964 wrote to memory of 584	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	76
PID 4964 wrote to memory of 584	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	76
PID 4964 wrote to memory of 584	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	76
PID 4964 wrote to memory of 652	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	2
PID 4964 wrote to memory of 652	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	2
PID 4964 wrote to memory of 652	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	2
PID 4964 wrote to memory of 652	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	2
PID 4964 wrote to memory of 652	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	2
PID 4964 wrote to memory of 652	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	2
PID 4964 wrote to memory of 768	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	74
PID 4964 wrote to memory of 768	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	74
PID 4964 wrote to memory of 768	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	74
PID 4964 wrote to memory of 768	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	74
PID 4964 wrote to memory of 768	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	74
PID 4964 wrote to memory of 768	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	74
PID 4964 wrote to memory of 776	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	3
PID 4964 wrote to memory of 776	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	3
PID 4964 wrote to memory of 776	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	3
PID 4964 wrote to memory of 776	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	3
PID 4964 wrote to memory of 776	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	3
PID 4964 wrote to memory of 776	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	3
PID 4964 wrote to memory of 784	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	73
PID 4964 wrote to memory of 784	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	73
PID 4964 wrote to memory of 784	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	73
PID 4964 wrote to memory of 784	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	73
PID 4964 wrote to memory of 784	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	73
PID 4964 wrote to memory of 784	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	73
PID 4964 wrote to memory of 880	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	72
PID 4964 wrote to memory of 880	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	72
PID 4964 wrote to memory of 880	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	72
PID 4964 wrote to memory of 880	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	72
PID 4964 wrote to memory of 880	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	72
PID 4964 wrote to memory of 880	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	72
PID 4964 wrote to memory of 940	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	71
PID 4964 wrote to memory of 940	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	71
PID 4964 wrote to memory of 940	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	71
PID 4964 wrote to memory of 940	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	71
PID 4964 wrote to memory of 940	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	71
PID 4964 wrote to memory of 940	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	71
PID 4964 wrote to memory of 1020	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	4
PID 4964 wrote to memory of 1020	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	4
PID 4964 wrote to memory of 1020	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	4
PID 4964 wrote to memory of 1020	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	4
PID 4964 wrote to memory of 1020	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	4
PID 4964 wrote to memory of 1020	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	4
PID 4964 wrote to memory of 436	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	70
PID 4964 wrote to memory of 436	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	70
PID 4964 wrote to memory of 436	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	70
PID 4964 wrote to memory of 436	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	70
PID 4964 wrote to memory of 436	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	70
PID 4964 wrote to memory of 436	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	70
PID 4964 wrote to memory of 732	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	69
PID 4964 wrote to memory of 732	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	69
PID 4964 wrote to memory of 732	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	69
PID 4964 wrote to memory of 732	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	69
PID 4964 wrote to memory of 732	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	69
PID 4964 wrote to memory of 732	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	69
PID 4964 wrote to memory of 712	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	5
PID 4964 wrote to memory of 712	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	5
PID 4964 wrote to memory of 712	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	5
PID 4964 wrote to memory of 712	4964	fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe	5

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:652

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2712

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5096

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4464

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4716

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4268

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3648

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3496

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3328

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2632

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3068
- C:\Users\Admin\AppData\Local\Temp\fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
  "C:\Users\Admin\AppData\Local\Temp\fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2624

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2444

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2340

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2152

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:880

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:768

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0 /state0:0xa39ee055 /state1:0x41c64e6d
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-135-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/4964-136-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download