Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 00:00
Static task
static1
Behavioral task
behavioral1
Sample
dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe
Resource
win7-20240221-en
General
-
Target
dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe
-
Size
2.7MB
-
MD5
f86ae0ab21191e40ccad928817144643
-
SHA1
5ac604256f9e7c428cbda9b31b401f9715f44646
-
SHA256
dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff
-
SHA512
807b4e5c831a1c3a5541edeee21b9281599c19d9fccbaa1f3004008ce544fb19edd39ab8a4a25748b2b14770f76895a8d1bf82e0cf2ac52ffbdc73d1a9be1ce3
-
SSDEEP
49152:OkjRhlIBG6uH6x5Ipt8/AibVeARh2gtpyviyMqO2BwLJuwJCVhrwGaX:OmIIKO4HRjjv3KuMDFQ
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe:*:enabled:@shell32.dll,-1" dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe -
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/404-14-0x00000000005A0000-0x00000000005DF000-memory.dmp UPX behavioral2/memory/404-25-0x0000000000400000-0x000000000043F000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe -
Loads dropped DLL 1 IoCs
pid Process 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe -
resource yara_rule behavioral2/memory/404-25-0x0000000000400000-0x000000000043F000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1636 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe 1636 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1360 1636 WerFault.exe 93 2524 404 WerFault.exe 97 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1636 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 404 1636 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe 97 PID 1636 wrote to memory of 404 1636 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe 97 PID 1636 wrote to memory of 404 1636 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe 97 PID 404 wrote to memory of 632 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 5 PID 404 wrote to memory of 632 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 5 PID 404 wrote to memory of 632 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 5 PID 404 wrote to memory of 632 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 5 PID 404 wrote to memory of 632 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 5 PID 404 wrote to memory of 632 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 5 PID 404 wrote to memory of 688 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 7 PID 404 wrote to memory of 688 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 7 PID 404 wrote to memory of 688 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 7 PID 404 wrote to memory of 688 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 7 PID 404 wrote to memory of 688 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 7 PID 404 wrote to memory of 688 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 7 PID 404 wrote to memory of 792 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 8 PID 404 wrote to memory of 792 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 8 PID 404 wrote to memory of 792 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 8 PID 404 wrote to memory of 792 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 8 PID 404 wrote to memory of 792 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 8 PID 404 wrote to memory of 792 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 8 PID 404 wrote to memory of 800 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 9 PID 404 wrote to memory of 800 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 9 PID 404 wrote to memory of 800 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 9 PID 404 wrote to memory of 800 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 9 PID 404 wrote to memory of 800 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 9 PID 404 wrote to memory of 800 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 9 PID 404 wrote to memory of 808 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 10 PID 404 wrote to memory of 808 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 10 PID 404 wrote to memory of 808 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 10 PID 404 wrote to memory of 808 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 10 PID 404 wrote to memory of 808 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 10 PID 404 wrote to memory of 808 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 10 PID 404 wrote to memory of 912 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 11 PID 404 wrote to memory of 912 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 11 PID 404 wrote to memory of 912 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 11 PID 404 wrote to memory of 912 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 11 PID 404 wrote to memory of 912 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 11 PID 404 wrote to memory of 912 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 11 PID 404 wrote to memory of 968 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 12 PID 404 wrote to memory of 968 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 12 PID 404 wrote to memory of 968 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 12 PID 404 wrote to memory of 968 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 12 PID 404 wrote to memory of 968 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 12 PID 404 wrote to memory of 968 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 12 PID 404 wrote to memory of 384 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 13 PID 404 wrote to memory of 384 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 13 PID 404 wrote to memory of 384 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 13 PID 404 wrote to memory of 384 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 13 PID 404 wrote to memory of 384 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 13 PID 404 wrote to memory of 384 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 13 PID 404 wrote to memory of 528 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 14 PID 404 wrote to memory of 528 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 14 PID 404 wrote to memory of 528 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 14 PID 404 wrote to memory of 528 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 14 PID 404 wrote to memory of 528 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 14 PID 404 wrote to memory of 528 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 14 PID 404 wrote to memory of 432 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 15 PID 404 wrote to memory of 432 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 15 PID 404 wrote to memory of 432 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 15 PID 404 wrote to memory of 432 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 15 PID 404 wrote to memory of 432 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 15 PID 404 wrote to memory of 432 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 15 PID 404 wrote to memory of 316 404 dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe 16
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:632
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:808
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:384
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:3168
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3720
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3820
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3928
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:4036
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3456
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4512
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:4424
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:2968
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:4944
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵PID:4624
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca2⤵PID:4064
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3872
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4704
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:1724
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵PID:432
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:316
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1208
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2488
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:3668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1328
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1456
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1492
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2392
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1936
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1948
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2012
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1792
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1828
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2088
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2688
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2776
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2792
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:2708
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe"C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaff.exe"2⤵
- Modifies firewall policy service
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exeC:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 6004⤵
- Program crash
PID:2524
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 7003⤵
- Program crash
PID:1360
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3496
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:2400
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1392
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:3476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:1220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:2544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:2456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffe66152e98,0x7ffe66152ea4,0x7ffe66152eb02⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2272 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:22⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:32⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2588 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:82⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5308 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:12⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5572 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:82⤵PID:3968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:2912
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:1340
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1636 -ip 16362⤵PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 404 -ip 4042⤵PID:3936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dcfb6d73a5a506b15a622c9adfe3d622ea1af7aa8fc78f8848265a6ca2b1aaffmgr.exe
Filesize240KB
MD5410283e841c8970b5945702fde8f7e72
SHA18fcf50336f1a2aeefc5edcf7875ffa5cadc361e4
SHA256cf60207e00045ed560e7580ef9223344cea11b94d4e96adafc84c0ae66152446
SHA5124368074c54fe0dc6c54f7d3342e195f79fc0262ca7918b95b3fc459c98f4267058b60cea7a9cb1843c09794ac8d5a7703d977c7b205715aaa0d5ec5219788933
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219