Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe
Resource
win10v2004-20220812-en
General
-
Target
55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe
-
Size
173KB
-
MD5
4741cc1a221ddf668170ec8040d2a749
-
SHA1
16f8ecc44276e8b644811ac0b83b27af82b12d5d
-
SHA256
55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb
-
SHA512
86f8a8d000728908d03627a5cfd6812f11fc03de484bbe02a21357b11c46e9ed790dc7c2e3da989397ce62654c8defe5f0b79e42967d4fc7581f8639e246b63d
-
SSDEEP
3072:Ynz2z/jMwe8Rco9+qol6WpJ/HAUZHfeEps4X:3z/t+SWPIKHfeGX
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe:*:enabled:@shell32.dll,-1" 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 612 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 2 PID 3952 wrote to memory of 612 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 2 PID 3952 wrote to memory of 612 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 2 PID 3952 wrote to memory of 612 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 2 PID 3952 wrote to memory of 612 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 2 PID 3952 wrote to memory of 612 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 2 PID 3952 wrote to memory of 668 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3 PID 3952 wrote to memory of 668 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3 PID 3952 wrote to memory of 668 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3 PID 3952 wrote to memory of 668 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3 PID 3952 wrote to memory of 668 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3 PID 3952 wrote to memory of 668 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 3 PID 3952 wrote to memory of 780 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 8 PID 3952 wrote to memory of 780 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 8 PID 3952 wrote to memory of 780 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 8 PID 3952 wrote to memory of 780 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 8 PID 3952 wrote to memory of 780 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 8 PID 3952 wrote to memory of 780 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 8 PID 3952 wrote to memory of 788 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 13 PID 3952 wrote to memory of 788 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 13 PID 3952 wrote to memory of 788 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 13 PID 3952 wrote to memory of 788 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 13 PID 3952 wrote to memory of 788 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 13 PID 3952 wrote to memory of 788 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 13 PID 3952 wrote to memory of 796 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 9 PID 3952 wrote to memory of 796 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 9 PID 3952 wrote to memory of 796 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 9 PID 3952 wrote to memory of 796 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 9 PID 3952 wrote to memory of 796 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 9 PID 3952 wrote to memory of 796 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 9 PID 3952 wrote to memory of 908 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 10 PID 3952 wrote to memory of 908 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 10 PID 3952 wrote to memory of 908 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 10 PID 3952 wrote to memory of 908 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 10 PID 3952 wrote to memory of 908 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 10 PID 3952 wrote to memory of 908 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 10 PID 3952 wrote to memory of 956 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 11 PID 3952 wrote to memory of 956 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 11 PID 3952 wrote to memory of 956 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 11 PID 3952 wrote to memory of 956 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 11 PID 3952 wrote to memory of 956 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 11 PID 3952 wrote to memory of 956 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 11 PID 3952 wrote to memory of 332 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 12 PID 3952 wrote to memory of 332 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 12 PID 3952 wrote to memory of 332 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 12 PID 3952 wrote to memory of 332 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 12 PID 3952 wrote to memory of 332 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 12 PID 3952 wrote to memory of 332 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 12 PID 3952 wrote to memory of 396 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 14 PID 3952 wrote to memory of 396 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 14 PID 3952 wrote to memory of 396 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 14 PID 3952 wrote to memory of 396 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 14 PID 3952 wrote to memory of 396 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 14 PID 3952 wrote to memory of 396 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 14 PID 3952 wrote to memory of 384 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 15 PID 3952 wrote to memory of 384 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 15 PID 3952 wrote to memory of 384 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 15 PID 3952 wrote to memory of 384 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 15 PID 3952 wrote to memory of 384 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 15 PID 3952 wrote to memory of 384 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 15 PID 3952 wrote to memory of 900 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 24 PID 3952 wrote to memory of 900 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 24 PID 3952 wrote to memory of 900 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 24 PID 3952 wrote to memory of 900 3952 55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe 24
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:780
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:332
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:796
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3288
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3380
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3456
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3540
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3720
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4480
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:4844
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca2⤵PID:3904
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:4640
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:396
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1124
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2900
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:952
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1328
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1196
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2560
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2552
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2476
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2344
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2144
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:1216
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1648
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1908
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1840
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1516
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3076
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe"C:\Users\Admin\AppData\Local\Temp\55eeda06d639784b51cc51e24507ac7dd86f2b0ec585465b65da011d42a036fb.exe"2⤵
- Modifies firewall policy service
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:1380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4076
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:1960
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:4952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:5048
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:2276