9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
Size

747KB
MD5

0a761a42df19f37b549f2d66ef97c4d9
SHA1

4d0ab7235271344e2b2508694068c102550b6b11
SHA256

9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e
SHA512

3035209e7c8426d8a85366b55c3a97f1abf8e92a41f13bdd0921720dc22e6d63787dc773690e90801d2a4cc548a5b4674321e8a0d4a15f9bc658b096ae6e62fa
SSDEEP

12288:85g44HH0xRmmIDemFDPuD0HOuxpPGAAoi57J6:85gTHHAgNPuYjuJ6

Score

10^/10

bootkit evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe:*:enabled:@shell32.dll,-1"	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\G:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\H:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\K:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\U:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\W:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\X:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\Z:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\E:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\I:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\M:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\P:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\S:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\N:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\O:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\Q:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\A:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\B:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\F:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\J:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\L:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\R:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\T:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\V:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
File opened (read-only)	\??\Y:	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 628	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	4
PID 2532 wrote to memory of 628	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	4
PID 2532 wrote to memory of 628	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	4
PID 2532 wrote to memory of 628	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	4
PID 2532 wrote to memory of 628	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	4
PID 2532 wrote to memory of 628	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	4
PID 2532 wrote to memory of 680	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	2
PID 2532 wrote to memory of 680	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	2
PID 2532 wrote to memory of 680	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	2
PID 2532 wrote to memory of 680	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	2
PID 2532 wrote to memory of 680	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	2
PID 2532 wrote to memory of 680	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	2
PID 2532 wrote to memory of 788	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	8
PID 2532 wrote to memory of 788	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	8
PID 2532 wrote to memory of 788	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	8
PID 2532 wrote to memory of 788	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	8
PID 2532 wrote to memory of 788	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	8
PID 2532 wrote to memory of 788	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	8
PID 2532 wrote to memory of 800	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	9
PID 2532 wrote to memory of 800	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	9
PID 2532 wrote to memory of 800	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	9
PID 2532 wrote to memory of 800	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	9
PID 2532 wrote to memory of 800	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	9
PID 2532 wrote to memory of 800	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	9
PID 2532 wrote to memory of 804	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	14
PID 2532 wrote to memory of 804	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	14
PID 2532 wrote to memory of 804	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	14
PID 2532 wrote to memory of 804	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	14
PID 2532 wrote to memory of 804	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	14
PID 2532 wrote to memory of 804	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	14
PID 2532 wrote to memory of 908	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	10
PID 2532 wrote to memory of 908	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	10
PID 2532 wrote to memory of 908	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	10
PID 2532 wrote to memory of 908	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	10
PID 2532 wrote to memory of 908	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	10
PID 2532 wrote to memory of 908	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	10
PID 2532 wrote to memory of 964	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	12
PID 2532 wrote to memory of 964	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	12
PID 2532 wrote to memory of 964	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	12
PID 2532 wrote to memory of 964	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	12
PID 2532 wrote to memory of 964	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	12
PID 2532 wrote to memory of 964	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	12
PID 2532 wrote to memory of 384	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	11
PID 2532 wrote to memory of 384	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	11
PID 2532 wrote to memory of 384	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	11
PID 2532 wrote to memory of 384	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	11
PID 2532 wrote to memory of 384	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	11
PID 2532 wrote to memory of 384	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	11
PID 2532 wrote to memory of 444	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	13
PID 2532 wrote to memory of 444	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	13
PID 2532 wrote to memory of 444	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	13
PID 2532 wrote to memory of 444	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	13
PID 2532 wrote to memory of 444	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	13
PID 2532 wrote to memory of 444	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	13
PID 2532 wrote to memory of 828	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	15
PID 2532 wrote to memory of 828	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	15
PID 2532 wrote to memory of 828	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	15
PID 2532 wrote to memory of 828	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	15
PID 2532 wrote to memory of 828	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	15
PID 2532 wrote to memory of 828	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	15
PID 2532 wrote to memory of 708	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	19
PID 2532 wrote to memory of 708	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	19
PID 2532 wrote to memory of 708	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	19
PID 2532 wrote to memory of 708	2532	9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe	19

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:384
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3372
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3276
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3440
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3484
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4244
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:2772
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:2164
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4672
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3704
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3584

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1328
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1368

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2864
- C:\Users\Admin\AppData\Local\Temp\9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe
  "C:\Users\Admin\AppData\Local\Temp\9cd64b52aa23c5bf8d31e6c5a46c762baaae46cdd704c8150d456483ae26de7e.exe"
  2⤵
  - Modifies firewall policy service
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2648

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-132-0x0000000000400000-0x00000000005B5000-memory.dmp

Filesize
1.7MB

Download
memory/2532-133-0x0000000000780000-0x0000000000783000-memory.dmp

Filesize
12KB

Download
memory/2532-134-0x0000000000400000-0x00000000005B5000-memory.dmp

Filesize
1.7MB

Download