phorphiex | d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9

General

Target

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
Size

110KB
MD5

373f3708061660dc78060c9259640e42
SHA1

b3771d48eb54913c946afa42a1eb6a4968e10277
SHA256

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9
SHA512

44efbfb595da8009d156cf84a8fc2543f16ed283110c3b9f2969cda45d570f898002a6e97252586eab5eef82720fcf148556ec41b2464a89e1c336a663b7be17
SSDEEP

1536:D3Mz8vZz71dUwH4pHfwbpBeSGStfFTReeeeeeeeWeeeeedAEVhB5N9B/2DMpWNr:Iw57zbH4xfwd7GStfFTf1Vt5a

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe:*:enabled:@shell32.dll,-1"	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysqxrdsvc.exe"	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Drops file in Windows directory 2 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	ioc	process
File created	C:\Windows\sysqxrdsvc.exe	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
File opened for modification	C:\Windows\sysqxrdsvc.exe	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3900 4624 WerFault.exe d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

pid	pid_target	process	target process
3900	4624	WerFault.exe	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

pid	process
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

pid	process
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description pid process

Token: SeDebugPrivilege 4624 d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	pid	process
Token: SeDebugPrivilege	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	pid	process	target process
PID 4624 wrote to memory of 624	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 4624 wrote to memory of 624	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 4624 wrote to memory of 624	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 4624 wrote to memory of 624	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 4624 wrote to memory of 624	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 4624 wrote to memory of 624	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 4624 wrote to memory of 672	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 4624 wrote to memory of 672	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 4624 wrote to memory of 672	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 4624 wrote to memory of 672	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 4624 wrote to memory of 672	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 4624 wrote to memory of 672	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 4624 wrote to memory of 792	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 792	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 792	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 792	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 792	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 792	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 800	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 800	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 800	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 800	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 800	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 800	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 808	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 808	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 808	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 808	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 808	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 808	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	fontdrvhost.exe
PID 4624 wrote to memory of 904	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 904	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 904	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 904	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 904	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 904	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 964	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 964	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 964	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 964	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 964	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 964	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 380	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	dwm.exe
PID 4624 wrote to memory of 380	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	dwm.exe
PID 4624 wrote to memory of 380	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	dwm.exe
PID 4624 wrote to memory of 380	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	dwm.exe
PID 4624 wrote to memory of 380	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	dwm.exe
PID 4624 wrote to memory of 380	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	dwm.exe
PID 4624 wrote to memory of 744	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 744	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 744	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 744	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 744	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 744	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 880	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 880	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 880	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 880	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 880	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 880	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 1060	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 1060	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 1060	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 4624 wrote to memory of 1060	4624	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:800

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:380

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:792

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
2⤵
PID:3040

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3744

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
2⤵
PID:3836

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3940

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
2⤵
PID:4020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:4152

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:5020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:4464

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
PID:5036

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
2⤵
PID:2436

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:768

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
2⤵
PID:2224

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3868

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1172

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1468

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1972

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2516

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3280

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3396

C:\Users\Admin\AppData\Local\Temp\d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
"C:\Users\Admin\AppData\Local\Temp\d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe"
2⤵
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 1352
3⤵
- Program crash
PID:3900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4484

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4624 -ip 4624
1⤵
PID:2176

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4624-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4624-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4624-3-0x0000000077863000-0x0000000077864000-memory.dmp

Filesize
4KB

Download
memory/4624-2-0x0000000077862000-0x0000000077863000-memory.dmp

Filesize
4KB

Download
memory/4624-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4624-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4624-10-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads