f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41

General

Target

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
Size

53KB
MD5

44e6841dbe421e7fffd7c65ed0c34ac4
SHA1

f4c7c4cb1eb50b49f4945fbc1a0910ae37a4f3d6
SHA256

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41
SHA512

d91ca24443bf64d2cceea4792d93bf9127eefb5e212d5d2147edfc60a5d8589ddf78667d5b44a0619738075e89bd6daa50b5c37ce782e5d267bda3656b8de4e7
SSDEEP

1536:9L2RmQVYNsWt5p/XJerUMdwgUHBKOeTygr:RFLp/JolQwOez

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe:*:enabled:@shell32.dll,-1"	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4376-132-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

description	ioc	process
File opened (read-only)	\??\M:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\O:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\W:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\I:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\J:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\L:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\U:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\Y:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\Z:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\H:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\S:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\T:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\Q:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\F:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\K:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\P:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\R:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\V:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\X:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\E:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\G:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
File opened (read-only)	\??\N:	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3456 4376 WerFault.exe f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

pid	pid_target	process	target process
3456	4376	WerFault.exe	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

pid	process
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

pid	process
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

description pid process

Token: SeDebugPrivilege 4376 f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

description	pid	process
Token: SeDebugPrivilege	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe

description	pid	process	target process
PID 4376 wrote to memory of 604	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 4376 wrote to memory of 604	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 4376 wrote to memory of 604	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 4376 wrote to memory of 604	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 4376 wrote to memory of 604	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 4376 wrote to memory of 604	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	winlogon.exe
PID 4376 wrote to memory of 656	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 4376 wrote to memory of 656	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 4376 wrote to memory of 656	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 4376 wrote to memory of 656	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 4376 wrote to memory of 656	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 4376 wrote to memory of 656	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	lsass.exe
PID 4376 wrote to memory of 764	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 764	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 764	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 764	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 764	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 764	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 776	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 776	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 776	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 776	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 776	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 776	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 784	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 784	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 784	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 784	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 784	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 784	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	fontdrvhost.exe
PID 4376 wrote to memory of 884	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 884	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 884	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 884	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 884	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 884	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 936	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 936	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 936	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 936	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 936	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 936	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 1008	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	dwm.exe
PID 4376 wrote to memory of 1008	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	dwm.exe
PID 4376 wrote to memory of 1008	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	dwm.exe
PID 4376 wrote to memory of 1008	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	dwm.exe
PID 4376 wrote to memory of 1008	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	dwm.exe
PID 4376 wrote to memory of 1008	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	dwm.exe
PID 4376 wrote to memory of 424	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 424	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 424	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 424	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 424	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 424	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 724	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 724	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 724	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 724	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 724	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 724	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 676	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 676	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 676	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe
PID 4376 wrote to memory of 676	4376	f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:656

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:784
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:764
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3424
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4472
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1380
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:3780
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2044
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4704
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4488
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3792
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3512
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3360
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1092
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4376 -ip 4376
  2⤵
  PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2700
- C:\Users\Admin\AppData\Local\Temp\f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe
  "C:\Users\Admin\AppData\Local\Temp\f393b5da536572f9f4e78adc9c3c5cf053cd8cdc5eeb5e192a18a73964623e41.exe"
  2⤵
  - Modifies firewall policy service
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 572
    3⤵
    - Program crash
    PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2780

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2420

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4376-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads