bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857

Analysis

max time kernel
152s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
Size

398KB
MD5

c2149ed82760d19630bb35c2468fc2f7
SHA1

6781f729b464183ae5c950e66db90ba538c584c9
SHA256

bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857
SHA512

23f1cdd70edeedbc8adda929e6efb321a96112a3b9014a9cdb0201d2acb86432b3d12f97d513a82ca4bb5e1f0728e2437dfd6538fec2c2290e88f4e8cfea8369
SSDEEP

6144:Pw0avOvtYSiod4uYzqAvZd/246FvmvxjdH3XE3XxkFKKpQevltHZBXcwyeN4pyT:IvGvViG4HOKZdeGvX34xnKCev3HbZ4C

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe:*:enabled:@shell32.dll,-1"	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000022e27-134.dat	acprotect
behavioral2/files/0x0007000000022e27-133.dat	acprotect
behavioral2/files/0x0007000000022e27-136.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
4760	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4760	580	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 604	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	3
PID 580 wrote to memory of 604	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	3
PID 580 wrote to memory of 604	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	3
PID 580 wrote to memory of 604	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	3
PID 580 wrote to memory of 604	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	3
PID 580 wrote to memory of 604	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	3
PID 580 wrote to memory of 664	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	4
PID 580 wrote to memory of 664	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	4
PID 580 wrote to memory of 664	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	4
PID 580 wrote to memory of 664	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	4
PID 580 wrote to memory of 664	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	4
PID 580 wrote to memory of 664	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	4
PID 580 wrote to memory of 776	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	8
PID 580 wrote to memory of 776	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	8
PID 580 wrote to memory of 776	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	8
PID 580 wrote to memory of 776	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	8
PID 580 wrote to memory of 776	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	8
PID 580 wrote to memory of 776	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	8
PID 580 wrote to memory of 792	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	9
PID 580 wrote to memory of 792	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	9
PID 580 wrote to memory of 792	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	9
PID 580 wrote to memory of 792	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	9
PID 580 wrote to memory of 792	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	9
PID 580 wrote to memory of 792	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	9
PID 580 wrote to memory of 800	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	79
PID 580 wrote to memory of 800	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	79
PID 580 wrote to memory of 800	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	79
PID 580 wrote to memory of 800	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	79
PID 580 wrote to memory of 800	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	79
PID 580 wrote to memory of 800	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	79
PID 580 wrote to memory of 896	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	10
PID 580 wrote to memory of 896	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	10
PID 580 wrote to memory of 896	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	10
PID 580 wrote to memory of 896	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	10
PID 580 wrote to memory of 896	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	10
PID 580 wrote to memory of 896	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	10
PID 580 wrote to memory of 948	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	11
PID 580 wrote to memory of 948	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	11
PID 580 wrote to memory of 948	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	11
PID 580 wrote to memory of 948	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	11
PID 580 wrote to memory of 948	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	11
PID 580 wrote to memory of 948	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	11
PID 580 wrote to memory of 312	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	78
PID 580 wrote to memory of 312	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	78
PID 580 wrote to memory of 312	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	78
PID 580 wrote to memory of 312	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	78
PID 580 wrote to memory of 312	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	78
PID 580 wrote to memory of 312	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	78
PID 580 wrote to memory of 532	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	12
PID 580 wrote to memory of 532	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	12
PID 580 wrote to memory of 532	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	12
PID 580 wrote to memory of 532	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	12
PID 580 wrote to memory of 532	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	12
PID 580 wrote to memory of 532	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	12
PID 580 wrote to memory of 676	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	77
PID 580 wrote to memory of 676	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	77
PID 580 wrote to memory of 676	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	77
PID 580 wrote to memory of 676	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	77
PID 580 wrote to memory of 676	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	77
PID 580 wrote to memory of 676	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	77
PID 580 wrote to memory of 944	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	76
PID 580 wrote to memory of 944	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	76
PID 580 wrote to memory of 944	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	76
PID 580 wrote to memory of 944	580	bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe	76

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:792
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:776
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4800
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3876
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:2332
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4560
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4396
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3700
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3560
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3468
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3400
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2576
- C:\Users\Admin\AppData\Local\Temp\bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe
  "C:\Users\Admin\AppData\Local\Temp\bec197f214511df3f0b20e621a84d7b7836699a467fda91052c6e5cc8bd3b857.exe"
  2⤵
  - Modifies firewall policy service
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1336
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2692

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2592

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2452

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2100

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:676

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 580 -ip 580
1⤵
PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vsiB8E5.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsiB8E5.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsiB8E5.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/580-132-0x0000000000400000-0x0000000000439800-memory.dmp

Filesize
230KB

Download
memory/580-135-0x00000000009D0000-0x0000000000A43000-memory.dmp

Filesize
460KB

Download
memory/580-137-0x0000000000400000-0x0000000000439800-memory.dmp

Filesize
230KB

Download