f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac

General

Target

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Size

72KB
MD5

5650bade2fcab78cce50b012a68bcf35
SHA1

24b6ca5cab1f0a14c361ef65ac4009c52399886f
SHA256

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac
SHA512

60c182baaedfa043dbd1219ef5740a376e44985e21e38e557c4bfbace015be95f3b083839bef8a8d6e54bfda3cf42be718822af6641947024c771edfe65eadd4
SSDEEP

1536:vdQ3Lwcn5gp+kj/z/xWiktzEhnPO3F8Jxta3XigpzYwhnmNLF:FOLwcnoj/z/xWikNEhG3F8ha3ygpUGn

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe:*:enabled:@shell32.dll,-1"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 13 IoCs

Processes:

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

pid	process
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

pid	process
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

description pid process

Token: SeDebugPrivilege 224 f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

description	pid	process
Token: SeDebugPrivilege	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

description	pid	process	target process
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	winlogon.exe
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	winlogon.exe
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	winlogon.exe
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	winlogon.exe
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	winlogon.exe
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	winlogon.exe
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	lsass.exe
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	lsass.exe
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	lsass.exe
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	lsass.exe
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	lsass.exe
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	lsass.exe
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	fontdrvhost.exe
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	dwm.exe
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	dwm.exe
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	dwm.exe
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	dwm.exe
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	dwm.exe
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	dwm.exe
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 904	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 904	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 904	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe
PID 224 wrote to memory of 904	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:768

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:1008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1068

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1384

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2872

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:984

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:832

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4068

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3764

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1992

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2716

C:\Users\Admin\AppData\Local\Temp\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
"C:\Users\Admin\AppData\Local\Temp\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe"
2⤵
- Modifies firewall policy service
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2516

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2412

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1668

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
2⤵
PID:4876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
2⤵
PID:2076

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-132-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download
memory/224-133-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads