15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc

Analysis

max time kernel
183s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
Size

224KB
MD5

7009c6ab0cfad4098b7aa34bd290d780
SHA1

ac376f7970755415748df042fac17578a840f6fe
SHA256

15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc
SHA512

b2dbb1f7bb0dbe64452a08db0b0e7ea4b0f9f89fc2eb7475557454eac465e714daedf78ef4dfad6c58647ac1f3a864fde0491458844418d31420406dfb620ad5
SSDEEP

6144:TzsTjPybOwj6Vt1Ab6wjeKY44cUAvldXpj7MKCDlNULAAOT:tkt1Abu42UlLEDsAT

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe:*:enabled:@shell32.dll,-1"	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe

ACProtect 1.3x - 1.4x DLL software 8 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000022dc9-133.dat	acprotect
behavioral2/files/0x0007000000022dc9-134.dat	acprotect
behavioral2/files/0x0006000000022dd4-139.dat	acprotect
behavioral2/files/0x0006000000022dd4-138.dat	acprotect
behavioral2/files/0x0006000000022dd4-144.dat	acprotect
behavioral2/files/0x0006000000022dd4-143.dat	acprotect
behavioral2/files/0x0007000000022dc9-145.dat	acprotect
behavioral2/files/0x0007000000022dc9-146.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1824	pufbqc.exe

Loads dropped DLL 8 IoCs

pid	Process
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
1824	pufbqc.exe
1824	pufbqc.exe
548	WerFault.exe
548	WerFault.exe
2232	WerFault.exe
2232	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pufbqc.exe	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
File opened for modification	C:\Windows\SysWOW64\pufbqc.exe	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	5088	WerFault.exe	36

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	pufbqc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pufbqc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
1824	pufbqc.exe
1824	pufbqc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
Token: SeDebugPrivilege	1824	pufbqc.exe
Token: SeIncBasePriorityPrivilege	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
1824	pufbqc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 624	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	3
PID 5088 wrote to memory of 624	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	3
PID 5088 wrote to memory of 624	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	3
PID 5088 wrote to memory of 624	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	3
PID 5088 wrote to memory of 624	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	3
PID 5088 wrote to memory of 624	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	3
PID 5088 wrote to memory of 680	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	1
PID 5088 wrote to memory of 680	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	1
PID 5088 wrote to memory of 680	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	1
PID 5088 wrote to memory of 680	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	1
PID 5088 wrote to memory of 680	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	1
PID 5088 wrote to memory of 680	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	1
PID 5088 wrote to memory of 784	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	8
PID 5088 wrote to memory of 784	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	8
PID 5088 wrote to memory of 784	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	8
PID 5088 wrote to memory of 784	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	8
PID 5088 wrote to memory of 784	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	8
PID 5088 wrote to memory of 784	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	8
PID 5088 wrote to memory of 816	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	13
PID 5088 wrote to memory of 816	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	13
PID 5088 wrote to memory of 816	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	13
PID 5088 wrote to memory of 816	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	13
PID 5088 wrote to memory of 816	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	13
PID 5088 wrote to memory of 816	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	13
PID 5088 wrote to memory of 828	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	12
PID 5088 wrote to memory of 828	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	12
PID 5088 wrote to memory of 828	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	12
PID 5088 wrote to memory of 828	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	12
PID 5088 wrote to memory of 828	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	12
PID 5088 wrote to memory of 828	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	12
PID 5088 wrote to memory of 920	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	11
PID 5088 wrote to memory of 920	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	11
PID 5088 wrote to memory of 920	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	11
PID 5088 wrote to memory of 920	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	11
PID 5088 wrote to memory of 920	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	11
PID 5088 wrote to memory of 920	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	11
PID 5088 wrote to memory of 968	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	10
PID 5088 wrote to memory of 968	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	10
PID 5088 wrote to memory of 968	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	10
PID 5088 wrote to memory of 968	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	10
PID 5088 wrote to memory of 968	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	10
PID 5088 wrote to memory of 968	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	10
PID 5088 wrote to memory of 376	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	9
PID 5088 wrote to memory of 376	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	9
PID 5088 wrote to memory of 376	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	9
PID 5088 wrote to memory of 376	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	9
PID 5088 wrote to memory of 376	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	9
PID 5088 wrote to memory of 376	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	9
PID 5088 wrote to memory of 540	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	14
PID 5088 wrote to memory of 540	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	14
PID 5088 wrote to memory of 540	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	14
PID 5088 wrote to memory of 540	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	14
PID 5088 wrote to memory of 540	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	14
PID 5088 wrote to memory of 540	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	14
PID 5088 wrote to memory of 704	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	19
PID 5088 wrote to memory of 704	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	19
PID 5088 wrote to memory of 704	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	19
PID 5088 wrote to memory of 704	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	19
PID 5088 wrote to memory of 704	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	19
PID 5088 wrote to memory of 704	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	19
PID 5088 wrote to memory of 1008	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	15
PID 5088 wrote to memory of 1008	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	15
PID 5088 wrote to memory of 1008	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	15
PID 5088 wrote to memory of 1008	5088	15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe	15

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:376
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1772
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:3232
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:620
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:748
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4620
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3948
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3784
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3596
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3504
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3436
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3332
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4696
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:3500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:920

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1084
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:892
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4652

C:\Users\Admin\AppData\Local\Temp\15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
"C:\Users\Admin\AppData\Local\Temp\15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe"
1⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 1396
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3144

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2888

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2572

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2080

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2344

C:\Windows\SysWOW64\pufbqc.exe
C:\Windows\SysWOW64\pufbqc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5088 -ip 5088
1⤵
- Loads dropped DLL
PID:548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pli6E98.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pli6E98.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pli6E98.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pli6E98.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Windows\SysWOW64\pufbqc.exe

Filesize
224KB

MD5
7009c6ab0cfad4098b7aa34bd290d780

SHA1
ac376f7970755415748df042fac17578a840f6fe

SHA256
15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc

SHA512
b2dbb1f7bb0dbe64452a08db0b0e7ea4b0f9f89fc2eb7475557454eac465e714daedf78ef4dfad6c58647ac1f3a864fde0491458844418d31420406dfb620ad5

Download Submit
C:\Windows\SysWOW64\pufbqc.exe

Filesize
224KB

MD5
7009c6ab0cfad4098b7aa34bd290d780

SHA1
ac376f7970755415748df042fac17578a840f6fe

SHA256
15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc

SHA512
b2dbb1f7bb0dbe64452a08db0b0e7ea4b0f9f89fc2eb7475557454eac465e714daedf78ef4dfad6c58647ac1f3a864fde0491458844418d31420406dfb620ad5

Download Submit
C:\Windows\Temp\pni829D.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Windows\Temp\pni829D.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Windows\Temp\pni829D.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Windows\Temp\pni829D.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/1824-147-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1824-141-0x0000000000D00000-0x0000000000D73000-memory.dmp

Filesize
460KB

Download
memory/1824-140-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1824-150-0x0000000000D00000-0x0000000000D73000-memory.dmp

Filesize
460KB

Download
memory/5088-142-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/5088-135-0x0000000000570000-0x00000000005E3000-memory.dmp

Filesize
460KB

Download
memory/5088-132-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5088-148-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/5088-149-0x0000000000570000-0x00000000005E3000-memory.dmp

Filesize
460KB

Download
memory/5088-151-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5088-152-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download