74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516

Analysis

max time kernel
124s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
Size

44KB
MD5

06323801e0e0cf8d813f499107c62216
SHA1

721d7c01a1b7e0f2d148544c5ab198d38d8d625c
SHA256

74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516
SHA512

87ba46509dfe57fac77988e56eaba701d7e22f90952c51f5ac97858fe702d745e263669dafc8e662646a320c3c5239a578c880121452247ffca15cd9e426557e
SSDEEP

768:Xpb55BIBjTguZGLrD/x1cCBzSzXa33NwLqZ45nHw8DgB+xYeys:Zb5uTvIrD/xtp33NZAxDk+ieys

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe:*:enabled:@shell32.dll,-1"	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 576	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	5
PID 4976 wrote to memory of 576	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	5
PID 4976 wrote to memory of 576	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	5
PID 4976 wrote to memory of 576	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	5
PID 4976 wrote to memory of 576	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	5
PID 4976 wrote to memory of 576	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	5
PID 4976 wrote to memory of 664	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	7
PID 4976 wrote to memory of 664	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	7
PID 4976 wrote to memory of 664	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	7
PID 4976 wrote to memory of 664	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	7
PID 4976 wrote to memory of 664	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	7
PID 4976 wrote to memory of 664	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	7
PID 4976 wrote to memory of 764	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	8
PID 4976 wrote to memory of 764	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	8
PID 4976 wrote to memory of 764	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	8
PID 4976 wrote to memory of 764	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	8
PID 4976 wrote to memory of 764	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	8
PID 4976 wrote to memory of 764	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	8
PID 4976 wrote to memory of 768	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	11
PID 4976 wrote to memory of 768	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	11
PID 4976 wrote to memory of 768	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	11
PID 4976 wrote to memory of 768	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	11
PID 4976 wrote to memory of 768	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	11
PID 4976 wrote to memory of 768	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	11
PID 4976 wrote to memory of 780	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	10
PID 4976 wrote to memory of 780	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	10
PID 4976 wrote to memory of 780	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	10
PID 4976 wrote to memory of 780	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	10
PID 4976 wrote to memory of 780	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	10
PID 4976 wrote to memory of 780	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	10
PID 4976 wrote to memory of 880	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	9
PID 4976 wrote to memory of 880	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	9
PID 4976 wrote to memory of 880	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	9
PID 4976 wrote to memory of 880	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	9
PID 4976 wrote to memory of 880	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	9
PID 4976 wrote to memory of 880	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	9
PID 4976 wrote to memory of 932	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	12
PID 4976 wrote to memory of 932	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	12
PID 4976 wrote to memory of 932	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	12
PID 4976 wrote to memory of 932	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	12
PID 4976 wrote to memory of 932	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	12
PID 4976 wrote to memory of 932	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	12
PID 4976 wrote to memory of 1012	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	13
PID 4976 wrote to memory of 1012	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	13
PID 4976 wrote to memory of 1012	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	13
PID 4976 wrote to memory of 1012	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	13
PID 4976 wrote to memory of 1012	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	13
PID 4976 wrote to memory of 1012	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	13
PID 4976 wrote to memory of 440	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	14
PID 4976 wrote to memory of 440	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	14
PID 4976 wrote to memory of 440	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	14
PID 4976 wrote to memory of 440	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	14
PID 4976 wrote to memory of 440	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	14
PID 4976 wrote to memory of 440	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	14
PID 4976 wrote to memory of 688	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	15
PID 4976 wrote to memory of 688	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	15
PID 4976 wrote to memory of 688	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	15
PID 4976 wrote to memory of 688	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	15
PID 4976 wrote to memory of 688	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	15
PID 4976 wrote to memory of 688	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	15
PID 4976 wrote to memory of 644	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	82
PID 4976 wrote to memory of 644	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	82
PID 4976 wrote to memory of 644	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	82
PID 4976 wrote to memory of 644	4976	74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe	82

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:576
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:768
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3428
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3652
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4412
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3528
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4748
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3368
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3276
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1688
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1596
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1304
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1464
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2432

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2544

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe
  "C:\Users\Admin\AppData\Local\Temp\74d2770aa01a908c03bab127f7548d32e779f2aedc6ab572e53894f7e2f51516.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2852

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4976-132-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download
memory/4976-133-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download