ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da

Analysis

max time kernel
192s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
Size

76KB
MD5

145c9edca1151d477e5c339b6d797cbd
SHA1

f09d773d50f87c47500305e79bc1e6fcf503ebd6
SHA256

ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da
SHA512

10f5d6cacbbc96fa22c097f5b519fe1738a5531820518af00cedf8ca9112808bc2c2871845f85f496a1d08695441262ab3ed57068e6d029ec1e5aabdb32d47df
SSDEEP

1536:bcPk2vG+Yq6GrXdOOq52m0HLxEulgsteEY+cZv8FYOicNx1q/6:v2vGM6GLdu52hHL6ulgsteEY+cZ90Nx1

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe:*:enabled:@shell32.dll,-1"	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe

Executes dropped EXE 1 IoCs

pid	Process
1048	kcimci.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\N:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\H:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\J:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\U:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\V:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\O:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\T:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\W:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\Y:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\L:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\M:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\P:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\Q:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\E:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\G:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\I:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\K:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\R:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\S:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\X:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened (read-only)	\??\Z:	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\kcimci.exe	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
File opened for modification	C:\Windows\kcimci.exe	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4572	2112	WerFault.exe	81

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	kcimci.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	kcimci.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	kcimci.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
1048	kcimci.exe
1048	kcimci.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
Token: SeDebugPrivilege	1048	kcimci.exe
Token: SeIncBasePriorityPrivilege	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 604	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	5
PID 2112 wrote to memory of 604	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	5
PID 2112 wrote to memory of 604	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	5
PID 2112 wrote to memory of 604	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	5
PID 2112 wrote to memory of 604	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	5
PID 2112 wrote to memory of 604	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	5
PID 2112 wrote to memory of 656	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	3
PID 2112 wrote to memory of 656	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	3
PID 2112 wrote to memory of 656	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	3
PID 2112 wrote to memory of 656	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	3
PID 2112 wrote to memory of 656	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	3
PID 2112 wrote to memory of 656	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	3
PID 2112 wrote to memory of 768	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	29
PID 2112 wrote to memory of 768	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	29
PID 2112 wrote to memory of 768	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	29
PID 2112 wrote to memory of 768	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	29
PID 2112 wrote to memory of 768	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	29
PID 2112 wrote to memory of 768	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	29
PID 2112 wrote to memory of 772	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	28
PID 2112 wrote to memory of 772	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	28
PID 2112 wrote to memory of 772	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	28
PID 2112 wrote to memory of 772	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	28
PID 2112 wrote to memory of 772	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	28
PID 2112 wrote to memory of 772	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	28
PID 2112 wrote to memory of 784	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	27
PID 2112 wrote to memory of 784	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	27
PID 2112 wrote to memory of 784	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	27
PID 2112 wrote to memory of 784	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	27
PID 2112 wrote to memory of 784	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	27
PID 2112 wrote to memory of 784	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	27
PID 2112 wrote to memory of 892	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	26
PID 2112 wrote to memory of 892	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	26
PID 2112 wrote to memory of 892	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	26
PID 2112 wrote to memory of 892	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	26
PID 2112 wrote to memory of 892	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	26
PID 2112 wrote to memory of 892	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	26
PID 2112 wrote to memory of 944	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	17
PID 2112 wrote to memory of 944	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	17
PID 2112 wrote to memory of 944	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	17
PID 2112 wrote to memory of 944	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	17
PID 2112 wrote to memory of 944	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	17
PID 2112 wrote to memory of 944	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	17
PID 2112 wrote to memory of 1004	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	16
PID 2112 wrote to memory of 1004	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	16
PID 2112 wrote to memory of 1004	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	16
PID 2112 wrote to memory of 1004	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	16
PID 2112 wrote to memory of 1004	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	16
PID 2112 wrote to memory of 1004	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	16
PID 2112 wrote to memory of 440	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	8
PID 2112 wrote to memory of 440	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	8
PID 2112 wrote to memory of 440	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	8
PID 2112 wrote to memory of 440	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	8
PID 2112 wrote to memory of 440	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	8
PID 2112 wrote to memory of 440	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	8
PID 2112 wrote to memory of 424	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	15
PID 2112 wrote to memory of 424	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	15
PID 2112 wrote to memory of 424	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	15
PID 2112 wrote to memory of 424	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	15
PID 2112 wrote to memory of 424	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	15
PID 2112 wrote to memory of 424	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	15
PID 2112 wrote to memory of 400	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	14
PID 2112 wrote to memory of 400	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	14
PID 2112 wrote to memory of 400	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	14
PID 2112 wrote to memory of 400	2112	ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe	14

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:656

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1004
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:400
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1280
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3676
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2012
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:3616
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3620
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1640
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1464
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:3400
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4000
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3516
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3432
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3364
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3260

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1624

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2660

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2528
- C:\Users\Admin\AppData\Local\Temp\ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe
  "C:\Users\Admin\AppData\Local\Temp\ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da.exe"
  2⤵
  - Modifies firewall policy service
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 604
    3⤵
    - Program crash
    PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2064

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1644

C:\Windows\kcimci.exe
C:\Windows\kcimci.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2112 -ip 2112
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\kcimci.exe

Filesize
76KB

MD5
145c9edca1151d477e5c339b6d797cbd

SHA1
f09d773d50f87c47500305e79bc1e6fcf503ebd6

SHA256
ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da

SHA512
10f5d6cacbbc96fa22c097f5b519fe1738a5531820518af00cedf8ca9112808bc2c2871845f85f496a1d08695441262ab3ed57068e6d029ec1e5aabdb32d47df

Download Submit
C:\Windows\kcimci.exe

Filesize
76KB

MD5
145c9edca1151d477e5c339b6d797cbd

SHA1
f09d773d50f87c47500305e79bc1e6fcf503ebd6

SHA256
ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da

SHA512
10f5d6cacbbc96fa22c097f5b519fe1738a5531820518af00cedf8ca9112808bc2c2871845f85f496a1d08695441262ab3ed57068e6d029ec1e5aabdb32d47df

Download Submit
memory/1048-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1048-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2112-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2112-136-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/2112-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2112-139-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/2112-141-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/2112-140-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download