91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
Size

52KB
MD5

08cf04b78af476a99039234b00831d10
SHA1

74b88ba8efe2c417e76c19d3d266045a58dec690
SHA256

91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba
SHA512

f56976f1de1a7ebf51efb5f8a3381e94506b2aae5d463aa0f2998790750c1575b7ce434ff5022e23b07329c8b69dc3d643d5dccc16e611ece87e5cf1480d4d71
SSDEEP

768:pAXariI4MMMlejQfx6rhSwzIBssRDKAyL8bl3QqyAh0Bmv3eS:TFfMZA0tSnlD2IFQqRqmn

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe:*:enabled:@shell32.dll,-1"	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4268	4816	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 632	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	3
PID 4816 wrote to memory of 632	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	3
PID 4816 wrote to memory of 632	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	3
PID 4816 wrote to memory of 632	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	3
PID 4816 wrote to memory of 632	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	3
PID 4816 wrote to memory of 632	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	3
PID 4816 wrote to memory of 688	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	1
PID 4816 wrote to memory of 688	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	1
PID 4816 wrote to memory of 688	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	1
PID 4816 wrote to memory of 688	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	1
PID 4816 wrote to memory of 688	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	1
PID 4816 wrote to memory of 688	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	1
PID 4816 wrote to memory of 796	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	8
PID 4816 wrote to memory of 796	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	8
PID 4816 wrote to memory of 796	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	8
PID 4816 wrote to memory of 796	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	8
PID 4816 wrote to memory of 796	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	8
PID 4816 wrote to memory of 796	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	8
PID 4816 wrote to memory of 804	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	9
PID 4816 wrote to memory of 804	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	9
PID 4816 wrote to memory of 804	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	9
PID 4816 wrote to memory of 804	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	9
PID 4816 wrote to memory of 804	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	9
PID 4816 wrote to memory of 804	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	9
PID 4816 wrote to memory of 812	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	78
PID 4816 wrote to memory of 812	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	78
PID 4816 wrote to memory of 812	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	78
PID 4816 wrote to memory of 812	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	78
PID 4816 wrote to memory of 812	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	78
PID 4816 wrote to memory of 812	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	78
PID 4816 wrote to memory of 916	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	77
PID 4816 wrote to memory of 916	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	77
PID 4816 wrote to memory of 916	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	77
PID 4816 wrote to memory of 916	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	77
PID 4816 wrote to memory of 916	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	77
PID 4816 wrote to memory of 916	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	77
PID 4816 wrote to memory of 972	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	76
PID 4816 wrote to memory of 972	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	76
PID 4816 wrote to memory of 972	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	76
PID 4816 wrote to memory of 972	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	76
PID 4816 wrote to memory of 972	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	76
PID 4816 wrote to memory of 972	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	76
PID 4816 wrote to memory of 404	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	10
PID 4816 wrote to memory of 404	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	10
PID 4816 wrote to memory of 404	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	10
PID 4816 wrote to memory of 404	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	10
PID 4816 wrote to memory of 404	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	10
PID 4816 wrote to memory of 404	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	10
PID 4816 wrote to memory of 440	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	11
PID 4816 wrote to memory of 440	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	11
PID 4816 wrote to memory of 440	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	11
PID 4816 wrote to memory of 440	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	11
PID 4816 wrote to memory of 440	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	11
PID 4816 wrote to memory of 440	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	11
PID 4816 wrote to memory of 672	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	12
PID 4816 wrote to memory of 672	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	12
PID 4816 wrote to memory of 672	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	12
PID 4816 wrote to memory of 672	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	12
PID 4816 wrote to memory of 672	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	12
PID 4816 wrote to memory of 672	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	12
PID 4816 wrote to memory of 388	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	75
PID 4816 wrote to memory of 388	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	75
PID 4816 wrote to memory of 388	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	75
PID 4816 wrote to memory of 388	4816	91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe	75

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:804
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4640
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3724
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4464
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3984
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3684
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3540
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3452
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3388
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2096

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1848

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4816 -ip 4816
  2⤵
  PID:5084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:968
- C:\Users\Admin\AppData\Local\Temp\91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe
  "C:\Users\Admin\AppData\Local\Temp\91818e5b04ea9e8b7a6d18419c7e845f376dfbaeb39cf23d7e540c7d7f7cb6ba.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1756
    3⤵
    - Program crash
    PID:4268

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2500

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:916

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4816-132-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download