Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 00:47
Static task
static1
Behavioral task
behavioral1
Sample
f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae.dll
Resource
win7-20240221-en
General
-
Target
f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae.dll
-
Size
2.6MB
-
MD5
a7ca6e19d542ff70f54e146cb0d93d79
-
SHA1
3b9b420e4f60914caeabf7a273346996f66e5c93
-
SHA256
f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae
-
SHA512
f0b73ed2c3d2188b3daf519147c4383d84a2d1c36be5a9512f4c32897ba70d3c6b6f2a29f29a494a76cb66cb1fff08d7d64ad273f50e3f37a8a9569287b85de5
-
SSDEEP
49152:+IUtVDYhD+MnjnTe8fgFoTp/kzg8YTys4EB15pthr8yD73j96Ae:zUDU/jnTecRVeg8DjEB1/zvDX96
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:enabled:@shell32.dll,-1" rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe -
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/files/0x0004000000022747-4.dat UPX behavioral2/memory/1860-5-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1860-15-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1044-21-0x0000000010000000-0x0000000010A31000-memory.dmp UPX -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 1860 rundll32Srv.exe -
resource yara_rule behavioral2/files/0x0004000000022747-4.dat upx behavioral2/memory/1860-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1860-15-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px8136.tmp rundll32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 3624 1044 WerFault.exe 87 3248 1860 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1860 rundll32Srv.exe 1860 rundll32Srv.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe 1860 rundll32Srv.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1860 rundll32Srv.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1044 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2608 wrote to memory of 1044 2608 rundll32.exe 87 PID 2608 wrote to memory of 1044 2608 rundll32.exe 87 PID 2608 wrote to memory of 1044 2608 rundll32.exe 87 PID 1044 wrote to memory of 1860 1044 rundll32.exe 91 PID 1044 wrote to memory of 1860 1044 rundll32.exe 91 PID 1044 wrote to memory of 1860 1044 rundll32.exe 91 PID 1860 wrote to memory of 588 1860 rundll32Srv.exe 5 PID 1860 wrote to memory of 588 1860 rundll32Srv.exe 5 PID 1860 wrote to memory of 588 1860 rundll32Srv.exe 5 PID 1860 wrote to memory of 588 1860 rundll32Srv.exe 5 PID 1860 wrote to memory of 588 1860 rundll32Srv.exe 5 PID 1860 wrote to memory of 588 1860 rundll32Srv.exe 5 PID 1860 wrote to memory of 668 1860 rundll32Srv.exe 7 PID 1860 wrote to memory of 668 1860 rundll32Srv.exe 7 PID 1860 wrote to memory of 668 1860 rundll32Srv.exe 7 PID 1860 wrote to memory of 668 1860 rundll32Srv.exe 7 PID 1860 wrote to memory of 668 1860 rundll32Srv.exe 7 PID 1860 wrote to memory of 668 1860 rundll32Srv.exe 7 PID 1860 wrote to memory of 784 1860 rundll32Srv.exe 8 PID 1860 wrote to memory of 784 1860 rundll32Srv.exe 8 PID 1860 wrote to memory of 784 1860 rundll32Srv.exe 8 PID 1860 wrote to memory of 784 1860 rundll32Srv.exe 8 PID 1860 wrote to memory of 784 1860 rundll32Srv.exe 8 PID 1860 wrote to memory of 784 1860 rundll32Srv.exe 8 PID 1860 wrote to memory of 788 1860 rundll32Srv.exe 9 PID 1860 wrote to memory of 788 1860 rundll32Srv.exe 9 PID 1860 wrote to memory of 788 1860 rundll32Srv.exe 9 PID 1860 wrote to memory of 788 1860 rundll32Srv.exe 9 PID 1860 wrote to memory of 788 1860 rundll32Srv.exe 9 PID 1860 wrote to memory of 788 1860 rundll32Srv.exe 9 PID 1860 wrote to memory of 804 1860 rundll32Srv.exe 10 PID 1860 wrote to memory of 804 1860 rundll32Srv.exe 10 PID 1860 wrote to memory of 804 1860 rundll32Srv.exe 10 PID 1860 wrote to memory of 804 1860 rundll32Srv.exe 10 PID 1860 wrote to memory of 804 1860 rundll32Srv.exe 10 PID 1860 wrote to memory of 804 1860 rundll32Srv.exe 10 PID 1860 wrote to memory of 904 1860 rundll32Srv.exe 11 PID 1860 wrote to memory of 904 1860 rundll32Srv.exe 11 PID 1860 wrote to memory of 904 1860 rundll32Srv.exe 11 PID 1860 wrote to memory of 904 1860 rundll32Srv.exe 11 PID 1860 wrote to memory of 904 1860 rundll32Srv.exe 11 PID 1860 wrote to memory of 904 1860 rundll32Srv.exe 11 PID 1860 wrote to memory of 964 1860 rundll32Srv.exe 12 PID 1860 wrote to memory of 964 1860 rundll32Srv.exe 12 PID 1860 wrote to memory of 964 1860 rundll32Srv.exe 12 PID 1860 wrote to memory of 964 1860 rundll32Srv.exe 12 PID 1860 wrote to memory of 964 1860 rundll32Srv.exe 12 PID 1860 wrote to memory of 964 1860 rundll32Srv.exe 12 PID 1860 wrote to memory of 60 1860 rundll32Srv.exe 13 PID 1860 wrote to memory of 60 1860 rundll32Srv.exe 13 PID 1860 wrote to memory of 60 1860 rundll32Srv.exe 13 PID 1860 wrote to memory of 60 1860 rundll32Srv.exe 13 PID 1860 wrote to memory of 60 1860 rundll32Srv.exe 13 PID 1860 wrote to memory of 60 1860 rundll32Srv.exe 13 PID 1860 wrote to memory of 432 1860 rundll32Srv.exe 14 PID 1860 wrote to memory of 432 1860 rundll32Srv.exe 14 PID 1860 wrote to memory of 432 1860 rundll32Srv.exe 14 PID 1860 wrote to memory of 432 1860 rundll32Srv.exe 14 PID 1860 wrote to memory of 432 1860 rundll32Srv.exe 14 PID 1860 wrote to memory of 432 1860 rundll32Srv.exe 14 PID 1860 wrote to memory of 720 1860 rundll32Srv.exe 15 PID 1860 wrote to memory of 720 1860 rundll32Srv.exe 15 PID 1860 wrote to memory of 720 1860 rundll32Srv.exe 15 PID 1860 wrote to memory of 720 1860 rundll32Srv.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:588
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:788
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:60
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:804
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:2612
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3708
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3812
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3912
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3996
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3356
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:1876
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:4556
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4704
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:4872
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:2988
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca2⤵PID:3648
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵PID:1016
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4612
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider2⤵PID:1808
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4528
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵PID:720
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1220
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2736
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:3136
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1456
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1500
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2520
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1608
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1660
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1932
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1944
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2036
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2060
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2108
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2596
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3232
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3336
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f727bf0b0632f3fe96a6c2acb8d3c5b1648f8c219e3dd01c81c5a6e5423796ae.dll,#13⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 3845⤵
- Program crash
PID:3248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 8004⤵
- Program crash
PID:3624
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3500
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3016
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:1940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4600
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1044 -ip 10441⤵PID:2968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1860 -ip 18601⤵PID:3128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5d105024666fce5e3ea84b1ad32c80fc6
SHA10114a2a0a254fe477c7a01274ed4b11f88b9d425
SHA256e9f7abdabf7c1e1e597cb402ebaab5033a481e54b917095032486e7d825bb151
SHA512ecf42cba45e36dfa921de688f27e1f411b503ad8d9555e58ae230fc1a266f18fed9a2454e8870b84f79ee6edfe67fbd99cb7973ab5296c3a8fc97e4f6f913a11