1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
Size

45KB
MD5

4c60a4552b61441e7c5ceb292eb5afe0
SHA1

009721d88026f9968514a2ad0ff31a84acab91a1
SHA256

1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f
SHA512

bae25d7bcf97a3cefd751742af1c26bcd61d4b3a57f126c34d4b262b0708f0a2f421fd569c2b5c40c36119d664c3ebf07a905c121679cf4c87685513b26c7fbc
SSDEEP

768:+blaZpxUesXxEwFVcCgUz+jwrZBngbHIqHrUbQvIyZLvCIIsoTSEVvQl+kT:+0HxUesBEwFMwlBn+drUblyZLaI2mEVs

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe:*:enabled:@shell32.dll,-1"	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 624	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	3
PID 3880 wrote to memory of 624	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	3
PID 3880 wrote to memory of 624	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	3
PID 3880 wrote to memory of 624	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	3
PID 3880 wrote to memory of 624	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	3
PID 3880 wrote to memory of 624	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	3
PID 3880 wrote to memory of 684	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	1
PID 3880 wrote to memory of 684	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	1
PID 3880 wrote to memory of 684	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	1
PID 3880 wrote to memory of 684	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	1
PID 3880 wrote to memory of 684	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	1
PID 3880 wrote to memory of 684	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	1
PID 3880 wrote to memory of 788	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	8
PID 3880 wrote to memory of 788	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	8
PID 3880 wrote to memory of 788	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	8
PID 3880 wrote to memory of 788	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	8
PID 3880 wrote to memory of 788	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	8
PID 3880 wrote to memory of 788	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	8
PID 3880 wrote to memory of 796	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	79
PID 3880 wrote to memory of 796	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	79
PID 3880 wrote to memory of 796	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	79
PID 3880 wrote to memory of 796	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	79
PID 3880 wrote to memory of 796	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	79
PID 3880 wrote to memory of 796	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	79
PID 3880 wrote to memory of 804	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	9
PID 3880 wrote to memory of 804	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	9
PID 3880 wrote to memory of 804	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	9
PID 3880 wrote to memory of 804	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	9
PID 3880 wrote to memory of 804	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	9
PID 3880 wrote to memory of 804	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	9
PID 3880 wrote to memory of 908	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	10
PID 3880 wrote to memory of 908	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	10
PID 3880 wrote to memory of 908	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	10
PID 3880 wrote to memory of 908	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	10
PID 3880 wrote to memory of 908	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	10
PID 3880 wrote to memory of 908	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	10
PID 3880 wrote to memory of 968	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	78
PID 3880 wrote to memory of 968	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	78
PID 3880 wrote to memory of 968	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	78
PID 3880 wrote to memory of 968	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	78
PID 3880 wrote to memory of 968	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	78
PID 3880 wrote to memory of 968	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	78
PID 3880 wrote to memory of 396	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	77
PID 3880 wrote to memory of 396	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	77
PID 3880 wrote to memory of 396	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	77
PID 3880 wrote to memory of 396	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	77
PID 3880 wrote to memory of 396	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	77
PID 3880 wrote to memory of 396	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	77
PID 3880 wrote to memory of 708	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	76
PID 3880 wrote to memory of 708	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	76
PID 3880 wrote to memory of 708	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	76
PID 3880 wrote to memory of 708	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	76
PID 3880 wrote to memory of 708	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	76
PID 3880 wrote to memory of 708	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	76
PID 3880 wrote to memory of 964	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	11
PID 3880 wrote to memory of 964	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	11
PID 3880 wrote to memory of 964	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	11
PID 3880 wrote to memory of 964	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	11
PID 3880 wrote to memory of 964	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	11
PID 3880 wrote to memory of 964	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	11
PID 3880 wrote to memory of 408	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	75
PID 3880 wrote to memory of 408	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	75
PID 3880 wrote to memory of 408	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	75
PID 3880 wrote to memory of 408	3880	1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe	75

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3476
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4488
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2384
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4808
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4624
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4384
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3720
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3572
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3408
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3320
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3120

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2824
- C:\Users\Admin\AppData\Local\Temp\1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe
  "C:\Users\Admin\AppData\Local\Temp\1ae24917d144d32ca357f1c8f97babead63a5c62fe40f95cce64740a318e6e5f.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3880

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2608

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2452

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2148

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3880-132-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download
memory/3880-133-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download