41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5

General

Target

41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
Size

76KB
MD5

137d545165c6ac217141379f2aa04380
SHA1

acf32f6a1f4b6e47509dfc2af8b6b7032da64533
SHA256

41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5
SHA512

9da146036f1f69365cfec7db2d3ab7aa33bef47f6d63496c9d61a70d4a6e239dea095a70cc64ba57c76cda62cf08273f63669cee41caa1a80d8f38eef8d41c2d
SSDEEP

1536:qbgP2zwn3/rPthev/u+EzSaf1M8vxqOpUH8gtLvd1UlcVcAWAbiiD:ygP0wn3/qhHd7C6VWPiD

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe:*:enabled:@shell32.dll,-1"	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

pid	process
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

pid	process
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

description pid process

Token: SeDebugPrivilege 1780 41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

description	pid	process
Token: SeDebugPrivilege	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe

description	pid	process	target process
PID 1780 wrote to memory of 632	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	winlogon.exe
PID 1780 wrote to memory of 632	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	winlogon.exe
PID 1780 wrote to memory of 632	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	winlogon.exe
PID 1780 wrote to memory of 632	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	winlogon.exe
PID 1780 wrote to memory of 632	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	winlogon.exe
PID 1780 wrote to memory of 632	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	winlogon.exe
PID 1780 wrote to memory of 684	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	lsass.exe
PID 1780 wrote to memory of 684	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	lsass.exe
PID 1780 wrote to memory of 684	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	lsass.exe
PID 1780 wrote to memory of 684	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	lsass.exe
PID 1780 wrote to memory of 684	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	lsass.exe
PID 1780 wrote to memory of 684	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	lsass.exe
PID 1780 wrote to memory of 792	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 792	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 792	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 792	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 792	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 792	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 800	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 800	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 800	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 800	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 800	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 800	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 808	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 808	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 808	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 808	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 808	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 808	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	fontdrvhost.exe
PID 1780 wrote to memory of 908	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 908	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 908	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 908	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 908	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 908	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 960	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 960	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 960	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 960	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 960	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 960	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 64	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	dwm.exe
PID 1780 wrote to memory of 64	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	dwm.exe
PID 1780 wrote to memory of 64	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	dwm.exe
PID 1780 wrote to memory of 64	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	dwm.exe
PID 1780 wrote to memory of 64	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	dwm.exe
PID 1780 wrote to memory of 64	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	dwm.exe
PID 1780 wrote to memory of 396	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 396	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 396	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 396	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 396	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 396	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 412	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 412	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 412	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 412	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 412	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 412	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 628	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 628	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 628	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe
PID 1780 wrote to memory of 628	1780	41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe	svchost.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:808
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:792
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3268
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3864
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3968
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4072
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:784
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4148
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:5056
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4668
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3368
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:1116
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1212

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1176
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2524
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:4724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1408
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2004

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2832

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2892

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3348
- C:\Users\Admin\AppData\Local\Temp\41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe
  "C:\Users\Admin\AppData\Local\Temp\41184730fe93cb2f49e0100a0e64ff7e656c31091e23803aab18347cc0848de5.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:416

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe83262e98,0x7ffe83262ea4,0x7ffe83262eb0
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2896 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2916 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3128 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5284 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5480 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-0-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download
memory/1780-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1780-3-0x0000000077A13000-0x0000000077A14000-memory.dmp

Filesize
4KB

Download
memory/1780-2-0x0000000077A12000-0x0000000077A13000-memory.dmp

Filesize
4KB

Download
memory/1780-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1780-5-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads