06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Size

60KB
MD5

2bc68ec94a7307089196520ad7e90230
SHA1

57bac4aa6a5a68bdf3388d64bfba67fac71072c4
SHA256

06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27
SHA512

90f891f67fd4b831a6b28c50faf874bf33de0d5f3612227a0e7d97c6aff08a85e1d5967749d4f17c4512bb75ee343d045bfb8d15b6aa9670fff5b9e032811366
SSDEEP

1536:etUhK/dfqu6SXSzjJu+WcgBkHnKGNKRYaAOJ66iLZ:etUKdSdSXSzjJu+Wcakqzqa56T

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe:*:enabled:@shell32.dll,-1"	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 7 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\Description = "Internet Explorer"	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\FileName = "IEXPLORE.EXE"	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\Version = "327680"	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Microsoft Input Devices	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Microsoft Input Devices\Mouse	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 588	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	5
PID 2220 wrote to memory of 588	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	5
PID 2220 wrote to memory of 588	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	5
PID 2220 wrote to memory of 588	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	5
PID 2220 wrote to memory of 588	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	5
PID 2220 wrote to memory of 588	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	5
PID 2220 wrote to memory of 676	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	6
PID 2220 wrote to memory of 676	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	6
PID 2220 wrote to memory of 676	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	6
PID 2220 wrote to memory of 676	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	6
PID 2220 wrote to memory of 676	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	6
PID 2220 wrote to memory of 676	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	6
PID 2220 wrote to memory of 760	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	78
PID 2220 wrote to memory of 760	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	78
PID 2220 wrote to memory of 760	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	78
PID 2220 wrote to memory of 760	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	78
PID 2220 wrote to memory of 760	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	78
PID 2220 wrote to memory of 760	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	78
PID 2220 wrote to memory of 768	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	77
PID 2220 wrote to memory of 768	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	77
PID 2220 wrote to memory of 768	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	77
PID 2220 wrote to memory of 768	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	77
PID 2220 wrote to memory of 768	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	77
PID 2220 wrote to memory of 768	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	77
PID 2220 wrote to memory of 788	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	76
PID 2220 wrote to memory of 788	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	76
PID 2220 wrote to memory of 788	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	76
PID 2220 wrote to memory of 788	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	76
PID 2220 wrote to memory of 788	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	76
PID 2220 wrote to memory of 788	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	76
PID 2220 wrote to memory of 908	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	75
PID 2220 wrote to memory of 908	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	75
PID 2220 wrote to memory of 908	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	75
PID 2220 wrote to memory of 908	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	75
PID 2220 wrote to memory of 908	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	75
PID 2220 wrote to memory of 908	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	75
PID 2220 wrote to memory of 956	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	74
PID 2220 wrote to memory of 956	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	74
PID 2220 wrote to memory of 956	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	74
PID 2220 wrote to memory of 956	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	74
PID 2220 wrote to memory of 956	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	74
PID 2220 wrote to memory of 956	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	74
PID 2220 wrote to memory of 336	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	8
PID 2220 wrote to memory of 336	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	8
PID 2220 wrote to memory of 336	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	8
PID 2220 wrote to memory of 336	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	8
PID 2220 wrote to memory of 336	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	8
PID 2220 wrote to memory of 336	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	8
PID 2220 wrote to memory of 396	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	73
PID 2220 wrote to memory of 396	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	73
PID 2220 wrote to memory of 396	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	73
PID 2220 wrote to memory of 396	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	73
PID 2220 wrote to memory of 396	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	73
PID 2220 wrote to memory of 396	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	73
PID 2220 wrote to memory of 460	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	72
PID 2220 wrote to memory of 460	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	72
PID 2220 wrote to memory of 460	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	72
PID 2220 wrote to memory of 460	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	72
PID 2220 wrote to memory of 460	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	72
PID 2220 wrote to memory of 460	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	72
PID 2220 wrote to memory of 632	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	71
PID 2220 wrote to memory of 632	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	71
PID 2220 wrote to memory of 632	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	71
PID 2220 wrote to memory of 632	2220	06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe	71

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:336
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:768

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4312

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3604

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4404

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3720

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3560

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3412

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:700
- C:\Users\Admin\AppData\Local\Temp\06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe
  "C:\Users\Admin\AppData\Local\Temp\06e29046e5f49f82f49194a41e19bd1d75e61dce200a6c022a822a91135f0c27.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2220

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2864

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2464

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:2008

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-132-0x0000000001000000-0x0000000001013000-memory.dmp

Filesize
76KB

Download
memory/2220-133-0x0000000001000000-0x0000000001013000-memory.dmp

Filesize
76KB

Download