b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca

General

Target

b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
Size

32KB
MD5

b4fe7df04499273f9b972086638c9a31
SHA1

c30dd3596e00729ee4e7581c01eb476a861b0b2b
SHA256

b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca
SHA512

13d3e9766762eab6eda93c4d7ac2fa4d60b9b588fd246258bbe6fbd08c4a07209c36d97471bd4233b6b73b2b00237d3d988ecbb94ffa07675d95bce60d2c385d

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe:*:enabled:@shell32.dll,-1"	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

pid	process
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

Suspicious behavior: MapViewOfSection 60 IoCs

Processes:

b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

pid	process
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

description pid process

Token: SeDebugPrivilege 1824 b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

description	pid	process
Token: SeDebugPrivilege	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe

description	pid	process	target process
PID 1824 wrote to memory of 552	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	winlogon.exe
PID 1824 wrote to memory of 636	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	lsass.exe
PID 1824 wrote to memory of 716	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 736	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	fontdrvhost.exe
PID 1824 wrote to memory of 804	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 984	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	dwm.exe
PID 1824 wrote to memory of 1008	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 480	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 480	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 480	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe
PID 1824 wrote to memory of 480	1824	b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:716

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1396

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3356

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:1840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:996

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3784

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3560

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3376

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2976

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe
"C:\Users\Admin\AppData\Local\Temp\b54b4dc749de76520e1b420d16b31bba4863138d28e43ae84ed5e9acff5db4ca.exe"
2⤵
- Modifies firewall policy service
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2864

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2680

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2600

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2592

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:3900

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2584

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2576

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2568

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2500

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2488

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2320

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b8
1⤵
PID:2276

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2148

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1540

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2004

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1876

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1776

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1632

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1564

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1548

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1492

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1304

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1256

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1244

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1160

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1044

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:948

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:684

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:480

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1008

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:984

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:804

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2⤵
PID:652

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:740

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:736

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:636

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:552

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:1052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads