dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
Size

66KB
MD5

4142861f8a1f69c677685a1cd012d4b0
SHA1

601d6b85e252e32e47033a93146dde61558a334b
SHA256

dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f
SHA512

539292b440990d6c72fda055da8a1459e91da7c56b265539a1546db1ea999c7b87010982caf4e6a6d4c7c68e4782e6e8679170ed431682e60f3428643b562dac
SSDEEP

1536:XbTcnujkqkSZZZ3gdtib8fHLakXID3k9xYHEDL:XbTcnujSUlb8fraEIyQEH

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe:*:enabled:@shell32.dll,-1"	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 608	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	6
PID 4448 wrote to memory of 608	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	6
PID 4448 wrote to memory of 608	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	6
PID 4448 wrote to memory of 608	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	6
PID 4448 wrote to memory of 608	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	6
PID 4448 wrote to memory of 608	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	6
PID 4448 wrote to memory of 676	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	4
PID 4448 wrote to memory of 676	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	4
PID 4448 wrote to memory of 676	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	4
PID 4448 wrote to memory of 676	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	4
PID 4448 wrote to memory of 676	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	4
PID 4448 wrote to memory of 676	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	4
PID 4448 wrote to memory of 788	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	13
PID 4448 wrote to memory of 788	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	13
PID 4448 wrote to memory of 788	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	13
PID 4448 wrote to memory of 788	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	13
PID 4448 wrote to memory of 788	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	13
PID 4448 wrote to memory of 788	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	13
PID 4448 wrote to memory of 796	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	12
PID 4448 wrote to memory of 796	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	12
PID 4448 wrote to memory of 796	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	12
PID 4448 wrote to memory of 796	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	12
PID 4448 wrote to memory of 796	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	12
PID 4448 wrote to memory of 796	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	12
PID 4448 wrote to memory of 804	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	11
PID 4448 wrote to memory of 804	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	11
PID 4448 wrote to memory of 804	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	11
PID 4448 wrote to memory of 804	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	11
PID 4448 wrote to memory of 804	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	11
PID 4448 wrote to memory of 804	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	11
PID 4448 wrote to memory of 912	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	10
PID 4448 wrote to memory of 912	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	10
PID 4448 wrote to memory of 912	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	10
PID 4448 wrote to memory of 912	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	10
PID 4448 wrote to memory of 912	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	10
PID 4448 wrote to memory of 912	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	10
PID 4448 wrote to memory of 972	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	9
PID 4448 wrote to memory of 972	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	9
PID 4448 wrote to memory of 972	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	9
PID 4448 wrote to memory of 972	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	9
PID 4448 wrote to memory of 972	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	9
PID 4448 wrote to memory of 972	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	9
PID 4448 wrote to memory of 408	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	8
PID 4448 wrote to memory of 408	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	8
PID 4448 wrote to memory of 408	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	8
PID 4448 wrote to memory of 408	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	8
PID 4448 wrote to memory of 408	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	8
PID 4448 wrote to memory of 408	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	8
PID 4448 wrote to memory of 540	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	14
PID 4448 wrote to memory of 540	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	14
PID 4448 wrote to memory of 540	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	14
PID 4448 wrote to memory of 540	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	14
PID 4448 wrote to memory of 540	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	14
PID 4448 wrote to memory of 540	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	14
PID 4448 wrote to memory of 424	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	15
PID 4448 wrote to memory of 424	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	15
PID 4448 wrote to memory of 424	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	15
PID 4448 wrote to memory of 424	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	15
PID 4448 wrote to memory of 424	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	15
PID 4448 wrote to memory of 424	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	15
PID 4448 wrote to memory of 932	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	81
PID 4448 wrote to memory of 932	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	81
PID 4448 wrote to memory of 932	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	81
PID 4448 wrote to memory of 932	4448	dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe	81

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:408
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3412
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4912
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4628
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:2372
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:4820
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3732
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3868
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3520
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3492
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3348
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3244
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1940

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1132
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2716

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2296

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2148

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1836

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2932
- C:\Users\Admin\AppData\Local\Temp\dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe
  "C:\Users\Admin\AppData\Local\Temp\dc70a862141c5c3e5cff791d7d2a5e4db606c256a406b6ed6815ae247fb8ef3f.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:5044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4448-132-0x0000000001000000-0x0000000001014000-memory.dmp

Filesize
80KB

Download