Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 03:34
Static task
static1
Behavioral task
behavioral1
Sample
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe
Resource
win7-20240221-en
General
-
Target
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe
-
Size
659KB
-
MD5
e13ff15767cb503c5cd4f45164052653
-
SHA1
7808a885d6c8a45d3d0efea3b6cc47ecd3e67bac
-
SHA256
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286
-
SHA512
be3d41a9d895bb41595bc9dd53cca815edb0e3f1ddcd8f55bab4640eae80e788f1d9bb3fa3659f9125a7a52682529a23e0369c272e74909a537503c01ca34f8b
-
SSDEEP
12288:QXejB4QXwj+m63qO7avALU96i7PcMBUAoKZOS30KRRJ6gwD:QXOBd93H3Y/PcMe/KZO20gKgwD
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 7 IoCs
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe:*:enabled:@shell32.dll,-1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 16 IoCs
Processes:
resource yara_rule behavioral2/memory/3736-1-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-4-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-7-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-10-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-13-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-15-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-16-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-17-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-18-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-19-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-20-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-21-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-22-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-23-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-25-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3736-26-0x0000000002460000-0x00000000034EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 17 IoCs
Processes:
resource yara_rule behavioral2/memory/3736-1-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-4-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-7-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-10-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-13-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-15-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-16-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-17-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-18-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-19-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-20-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-21-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-22-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-23-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-25-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-26-0x0000000002460000-0x00000000034EE000-memory.dmp UPX behavioral2/memory/3736-44-0x0000000000400000-0x00000000004AB000-memory.dmp UPX -
Processes:
resource yara_rule behavioral2/memory/3736-1-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-4-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-7-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-10-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-13-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-15-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-16-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-17-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-18-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-19-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-20-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-21-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-22-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-23-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-25-0x0000000002460000-0x00000000034EE000-memory.dmp upx behavioral2/memory/3736-26-0x0000000002460000-0x00000000034EE000-memory.dmp upx -
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription ioc process File opened (read-only) \??\E: dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Drops file in Windows directory 1 IoCs
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exepid process 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exepid process 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription pid process Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe Token: SeDebugPrivilege 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription pid process target process PID 3736 wrote to memory of 632 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe winlogon.exe PID 3736 wrote to memory of 632 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe winlogon.exe PID 3736 wrote to memory of 632 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe winlogon.exe PID 3736 wrote to memory of 632 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe winlogon.exe PID 3736 wrote to memory of 632 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe winlogon.exe PID 3736 wrote to memory of 632 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe winlogon.exe PID 3736 wrote to memory of 680 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe lsass.exe PID 3736 wrote to memory of 680 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe lsass.exe PID 3736 wrote to memory of 680 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe lsass.exe PID 3736 wrote to memory of 680 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe lsass.exe PID 3736 wrote to memory of 680 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe lsass.exe PID 3736 wrote to memory of 680 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe lsass.exe PID 3736 wrote to memory of 776 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 776 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 776 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 776 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 776 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 776 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 784 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 784 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 784 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 784 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 784 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 784 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe fontdrvhost.exe PID 3736 wrote to memory of 804 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 804 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 804 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 804 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 804 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 804 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 920 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 920 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 920 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 920 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 920 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 920 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 968 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 968 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 968 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 968 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 968 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 968 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 392 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe dwm.exe PID 3736 wrote to memory of 392 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe dwm.exe PID 3736 wrote to memory of 392 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe dwm.exe PID 3736 wrote to memory of 392 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe dwm.exe PID 3736 wrote to memory of 392 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe dwm.exe PID 3736 wrote to memory of 392 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe dwm.exe PID 3736 wrote to memory of 528 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 528 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 528 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 528 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 528 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 528 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 712 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 712 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 712 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 712 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 712 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 712 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 1020 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 1020 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 1020 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe PID 3736 wrote to memory of 1020 3736 dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe"C:\Users\Admin\AppData\Local\Temp\dbb56d195eb5e12ebf3bb4459e5fb6f495e4a38eafa8845c86d29a270fd31286.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3736-0-0x0000000000400000-0x00000000004AB000-memory.dmpFilesize
684KB
-
memory/3736-1-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-2-0x000000007FDE0000-0x000000007FDEC000-memory.dmpFilesize
48KB
-
memory/3736-4-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-6-0x000000007FDE0000-0x000000007FDEC000-memory.dmpFilesize
48KB
-
memory/3736-5-0x0000000077272000-0x0000000077273000-memory.dmpFilesize
4KB
-
memory/3736-8-0x0000000077273000-0x0000000077274000-memory.dmpFilesize
4KB
-
memory/3736-9-0x0000000003AA0000-0x0000000003AA1000-memory.dmpFilesize
4KB
-
memory/3736-7-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-10-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-12-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/3736-11-0x00000000047D0000-0x00000000047D2000-memory.dmpFilesize
8KB
-
memory/3736-13-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-14-0x00000000047D0000-0x00000000047D2000-memory.dmpFilesize
8KB
-
memory/3736-15-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-16-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-17-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-18-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-19-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-20-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-21-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-22-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-23-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-25-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-26-0x0000000002460000-0x00000000034EE000-memory.dmpFilesize
16.6MB
-
memory/3736-35-0x00000000047D0000-0x00000000047D2000-memory.dmpFilesize
8KB
-
memory/3736-41-0x000000007FDE0000-0x000000007FDEC000-memory.dmpFilesize
48KB
-
memory/3736-44-0x0000000000400000-0x00000000004AB000-memory.dmpFilesize
684KB