f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac

Analysis

max time kernel
176s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Size

72KB
MD5

5650bade2fcab78cce50b012a68bcf35
SHA1

24b6ca5cab1f0a14c361ef65ac4009c52399886f
SHA256

f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac
SHA512

60c182baaedfa043dbd1219ef5740a376e44985e21e38e557c4bfbace015be95f3b083839bef8a8d6e54bfda3cf42be718822af6641947024c771edfe65eadd4
SSDEEP

1536:vdQ3Lwcn5gp+kj/z/xWiktzEhnPO3F8Jxta3XigpzYwhnmNLF:FOLwcnoj/z/xWikNEhG3F8ha3ygpUGn

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe:*:enabled:@shell32.dll,-1"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 224 wrote to memory of 604	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	3
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 224 wrote to memory of 664	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	1
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	8
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	8
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	8
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	8
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	8
PID 224 wrote to memory of 768	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	8
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	79
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	79
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	79
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	79
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	79
PID 224 wrote to memory of 772	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	79
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	78
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	78
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	78
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	78
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	78
PID 224 wrote to memory of 784	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	78
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	77
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	77
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	77
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	77
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	77
PID 224 wrote to memory of 884	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	77
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	76
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	76
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	76
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	76
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	76
PID 224 wrote to memory of 940	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	76
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	75
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	75
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	75
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	75
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	75
PID 224 wrote to memory of 1008	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	75
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	74
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	74
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	74
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	74
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	74
PID 224 wrote to memory of 428	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	74
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	9
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	9
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	9
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	9
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	9
PID 224 wrote to memory of 744	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	9
PID 224 wrote to memory of 904	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	73
PID 224 wrote to memory of 904	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	73
PID 224 wrote to memory of 904	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	73
PID 224 wrote to memory of 904	224	f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe	73

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:768
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1068
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1384

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2872

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:984

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:832

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4068

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3764

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1992

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2716
- C:\Users\Admin\AppData\Local\Temp\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe
  "C:\Users\Admin\AppData\Local\Temp\f1c764c960017d1d341653178d7a79ebc2e176b1d1015d00e2afd71c3fe3f0ac.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2516

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2412

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1668

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:4876
- C:\Windows\System32\rundll32.exe
  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
  2⤵
  PID:2076

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-132-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download
memory/224-133-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download