Analysis
-
max time kernel
1621s -
max time network
1593s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-06-2022 17:44
Static task
static1
Behavioral task
behavioral1
Sample
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe
Resource
win10v2004-20220414-en
General
-
Target
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe
-
Size
1.2MB
-
MD5
565c85a0453acfc64f84cbc70b763efc
-
SHA1
a1e50ea1cf93a8d9922789863a60057d0629aacf
-
SHA256
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9
-
SHA512
d9bbfbfedfeacf9c3da39069a6049ecbc69b9eb23b891c981dbec8cfc5dfb54f5ba65a3b68e71ddcf0c18cdb724779c4a94f68401bd6d655d02128012ff9d799
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe:*:enabled:@shell32.dll,-1" db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe -
Drops file in Drivers directory 1 IoCs
Processes:
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exepid process 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe -
Suspicious behavior: MapViewOfSection 63 IoCs
Processes:
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exepid process 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exedescription pid process Token: SeDebugPrivilege 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exedescription pid process target process PID 3648 wrote to memory of 612 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe winlogon.exe PID 3648 wrote to memory of 612 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe winlogon.exe PID 3648 wrote to memory of 612 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe winlogon.exe PID 3648 wrote to memory of 612 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe winlogon.exe PID 3648 wrote to memory of 612 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe winlogon.exe PID 3648 wrote to memory of 612 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe winlogon.exe PID 3648 wrote to memory of 668 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe lsass.exe PID 3648 wrote to memory of 668 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe lsass.exe PID 3648 wrote to memory of 668 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe lsass.exe PID 3648 wrote to memory of 668 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe lsass.exe PID 3648 wrote to memory of 668 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe lsass.exe PID 3648 wrote to memory of 668 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe lsass.exe PID 3648 wrote to memory of 780 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 780 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 780 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 780 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 780 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 780 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 808 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 808 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 808 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 808 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 808 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 808 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 816 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 816 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 816 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 816 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 816 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 816 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe fontdrvhost.exe PID 3648 wrote to memory of 908 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 908 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 908 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 908 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 908 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 908 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 956 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 956 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 956 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 956 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 956 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 956 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 312 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe dwm.exe PID 3648 wrote to memory of 312 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe dwm.exe PID 3648 wrote to memory of 312 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe dwm.exe PID 3648 wrote to memory of 312 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe dwm.exe PID 3648 wrote to memory of 312 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe dwm.exe PID 3648 wrote to memory of 312 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe dwm.exe PID 3648 wrote to memory of 540 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 540 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 540 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 540 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 540 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 540 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 684 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 684 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 684 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 684 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 684 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 684 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 428 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 428 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 428 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe PID 3648 wrote to memory of 428 3648 db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:780
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3556
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3488
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3400
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4188
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:3584
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:1652
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3872
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:428
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1068
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1116
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2924
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:2848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:1720
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:5104
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4532
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe"C:\Users\Admin\AppData\Local\Temp\db31610f5c10f0508c2b619c60ded2833bb388750ce0b0ab6b88b0452827fec9.exe"2⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2812
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2560
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2412
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2372
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2184
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2144
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1888
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1928
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1616
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1420
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3648-130-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB