Malware Analysis Report

2024-11-13 18:05

Sample ID 241110-b1lxfaxajd
Target 2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia
SHA256 e004805c96a0adce46eec92c68d439994e1840e6e671964ac150505d09d1378a
Tags
discovery evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e004805c96a0adce46eec92c68d439994e1840e6e671964ac150505d09d1378a

Threat Level: Known bad

The file 2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia was found to be: Known bad.

Malicious Activity Summary

discovery evasion persistence

Modifies firewall policy service

Adds Run key to start application

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookAW

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 01:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-10 01:36

Reported

2024-11-10 01:39

Platform

win10v2004-20241007-en

Max time kernel

96s

Max time network

148s

Command Line

winlogon.exe

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe:*:enabled:@shell32.dll,-1" C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\T-5060548008706965508605070\\winsvc.exe" C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\T-5060548008706965508605070\\winsvc.exe" C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\T-5060548008706965508605070\winsvc.exe C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
File opened for modification C:\Windows\T-5060548008706965508605070\winsvc.exe C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
File opened for modification C:\Windows\T-5060548008706965508605070 C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious use of SetWindowsHookAW

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5052 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 5052 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 5052 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 5052 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 5052 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 5052 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 5052 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 5052 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 5052 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 5052 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 5052 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 5052 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 5052 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\fontdrvhost.exe
PID 5052 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\dwm.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\dwm.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\dwm.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\dwm.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\dwm.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\dwm.exe
PID 5052 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 5052 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 5052 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\MusNotification.exe

C:\Windows\system32\MusNotification.exe

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5052 -ip 5052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1364

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 vb.rubon.at udp
US 8.8.8.8:53 c7.polgo.pl udp
US 8.8.8.8:53 spn.samb.pl udp
US 8.8.8.8:53 xez.dizz.at udp
US 199.59.243.227:80 xez.dizz.at tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 227.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/5052-0-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/5052-1-0x0000000000400000-0x0000000003B91000-memory.dmp

memory/5052-3-0x00000000778C3000-0x00000000778C4000-memory.dmp

memory/5052-2-0x00000000778C2000-0x00000000778C3000-memory.dmp

memory/5052-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/5052-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/5052-6-0x0000000003D10000-0x0000000003D14000-memory.dmp

memory/5052-7-0x0000000000400000-0x0000000000408000-memory.dmp

memory/5052-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/5052-9-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/5052-13-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/5052-16-0x0000000000400000-0x0000000003B91000-memory.dmp

memory/5052-17-0x0000000003D10000-0x0000000003D14000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 01:36

Reported

2024-11-10 01:39

Platform

win7-20240729-en

Max time kernel

120s

Max time network

120s

Command Line

wininit.exe

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\T-5060548008706965508605070\\winsvc.exe" C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\T-5060548008706965508605070\\winsvc.exe" C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\T-5060548008706965508605070\winsvc.exe C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
File opened for modification C:\Windows\T-5060548008706965508605070\winsvc.exe C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
File opened for modification C:\Windows\T-5060548008706965508605070 C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious use of SetWindowsHookAW

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2756 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\wininit.exe
PID 2756 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\wininit.exe
PID 2756 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\wininit.exe
PID 2756 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\wininit.exe
PID 2756 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\wininit.exe
PID 2756 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\wininit.exe
PID 2756 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\wininit.exe
PID 2756 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\csrss.exe
PID 2756 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\csrss.exe
PID 2756 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\csrss.exe
PID 2756 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\csrss.exe
PID 2756 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\csrss.exe
PID 2756 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\csrss.exe
PID 2756 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\csrss.exe
PID 2756 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 2756 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 2756 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 2756 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 2756 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 2756 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 2756 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\winlogon.exe
PID 2756 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\services.exe
PID 2756 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\services.exe
PID 2756 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\services.exe
PID 2756 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\services.exe
PID 2756 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\services.exe
PID 2756 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\services.exe
PID 2756 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\services.exe
PID 2756 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 2756 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 2756 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 2756 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 2756 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 2756 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 2756 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsass.exe
PID 2756 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsm.exe
PID 2756 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsm.exe
PID 2756 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsm.exe
PID 2756 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsm.exe
PID 2756 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsm.exe
PID 2756 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsm.exe
PID 2756 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\lsm.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\system32\svchost.exe
PID 2756 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 2756 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 2756 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 2756 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 2756 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 2756 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 2756 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe
PID 2756 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Users\Admin\AppData\Local\Temp\2029168519\zmstage.exe

C:\Users\Admin\AppData\Local\Temp\2029168519\zmstage.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-10_a9961e9e258d55032a28d209ea3b8f39_mafia.exe"

Network

N/A

Files

memory/2756-0-0x0000000000400000-0x0000000003B91000-memory.dmp

memory/2756-4-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2756-3-0x0000000000230000-0x0000000000234000-memory.dmp

memory/2756-2-0x0000000076F3F000-0x0000000076F40000-memory.dmp

memory/2756-1-0x0000000076F40000-0x0000000076F41000-memory.dmp

memory/2756-5-0x0000000000400000-0x0000000003B91000-memory.dmp