b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1

Analysis

max time kernel
171s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
Size

224KB
MD5

2c9e43abb03188f1515fa758b71daf3d
SHA1

b0271512ff89f1f970498e45b9e716d046081d96
SHA256

b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1
SHA512

3c214d79f26ce26e7f3e7d0ad61321851fef33f70cebbb0ebecc6b2e22c037c61ea1dd545a68b4dbe32be60824b4eb97bf979eddd22dab9949ffb1b60a973193
SSDEEP

3072:SQID51D6aq4zJNeSjv0NGzsP8PtaDItNwW1NJB33FBkDxhZN0102QDBe4dgdEsVw:dZYBVP7fZTvov4AjtRfMkmG

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe:*:enabled:@shell32.dll,-1"	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
208	4844	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 580	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	7
PID 4844 wrote to memory of 580	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	7
PID 4844 wrote to memory of 580	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	7
PID 4844 wrote to memory of 580	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	7
PID 4844 wrote to memory of 580	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	7
PID 4844 wrote to memory of 580	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	7
PID 4844 wrote to memory of 660	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	5
PID 4844 wrote to memory of 660	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	5
PID 4844 wrote to memory of 660	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	5
PID 4844 wrote to memory of 660	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	5
PID 4844 wrote to memory of 660	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	5
PID 4844 wrote to memory of 660	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	5
PID 4844 wrote to memory of 772	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	8
PID 4844 wrote to memory of 772	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	8
PID 4844 wrote to memory of 772	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	8
PID 4844 wrote to memory of 772	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	8
PID 4844 wrote to memory of 772	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	8
PID 4844 wrote to memory of 772	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	8
PID 4844 wrote to memory of 780	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	9
PID 4844 wrote to memory of 780	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	9
PID 4844 wrote to memory of 780	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	9
PID 4844 wrote to memory of 780	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	9
PID 4844 wrote to memory of 780	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	9
PID 4844 wrote to memory of 780	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	9
PID 4844 wrote to memory of 788	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	66
PID 4844 wrote to memory of 788	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	66
PID 4844 wrote to memory of 788	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	66
PID 4844 wrote to memory of 788	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	66
PID 4844 wrote to memory of 788	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	66
PID 4844 wrote to memory of 788	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	66
PID 4844 wrote to memory of 892	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	65
PID 4844 wrote to memory of 892	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	65
PID 4844 wrote to memory of 892	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	65
PID 4844 wrote to memory of 892	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	65
PID 4844 wrote to memory of 892	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	65
PID 4844 wrote to memory of 892	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	65
PID 4844 wrote to memory of 952	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	64
PID 4844 wrote to memory of 952	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	64
PID 4844 wrote to memory of 952	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	64
PID 4844 wrote to memory of 952	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	64
PID 4844 wrote to memory of 952	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	64
PID 4844 wrote to memory of 952	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	64
PID 4844 wrote to memory of 1016	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	10
PID 4844 wrote to memory of 1016	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	10
PID 4844 wrote to memory of 1016	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	10
PID 4844 wrote to memory of 1016	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	10
PID 4844 wrote to memory of 1016	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	10
PID 4844 wrote to memory of 1016	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	10
PID 4844 wrote to memory of 404	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	11
PID 4844 wrote to memory of 404	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	11
PID 4844 wrote to memory of 404	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	11
PID 4844 wrote to memory of 404	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	11
PID 4844 wrote to memory of 404	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	11
PID 4844 wrote to memory of 404	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	11
PID 4844 wrote to memory of 836	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	63
PID 4844 wrote to memory of 836	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	63
PID 4844 wrote to memory of 836	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	63
PID 4844 wrote to memory of 836	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	63
PID 4844 wrote to memory of 836	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	63
PID 4844 wrote to memory of 836	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	63
PID 4844 wrote to memory of 908	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	12
PID 4844 wrote to memory of 908	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	12
PID 4844 wrote to memory of 908	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	12
PID 4844 wrote to memory of 908	4844	b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe	12

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:580
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:772
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1132
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2868
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1304
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2320

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2476

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2584
- C:\Users\Admin\AppData\Local\Temp\b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe
  "C:\Users\Admin\AppData\Local\Temp\b95afd7573d107527cfadb2dd98c36469e28d0ee65ceef362c3d034e11bbccb1.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 760
    3⤵
    - Program crash
    PID:208

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3408

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2108

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1660

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1928

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1504

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4836
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4212
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4844 -ip 4844
  2⤵
  PID:3228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-132-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4844-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4844-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download