54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f

Analysis

max time kernel
85s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
Size

182KB
MD5

4b79b80e0a1bef49b59ccce3c898e510
SHA1

951a39800166b21745e0233be951a83a655daf71
SHA256

54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f
SHA512

69a056f5cf39febfd599475a34a33a81159f3579491592baacb9c86b6d105127acb5d717a3dc649a4f9d26b1e0d27ddb513543dfae32fef06bd243bdc326f6d7
SSDEEP

3072:tXmfcwlVCoCAqagxSavqOYDW0UxjHL/F9BRqKY5nTSm9nUb3D4TQdam7:9mUw71CD+aveDlUxjHL/F9B0KY5n2ma/

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe:*:enabled:@shell32.dll,-1"	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 616	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	3
PID 3188 wrote to memory of 616	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	3
PID 3188 wrote to memory of 616	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	3
PID 3188 wrote to memory of 616	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	3
PID 3188 wrote to memory of 616	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	3
PID 3188 wrote to memory of 616	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	3
PID 3188 wrote to memory of 692	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	1
PID 3188 wrote to memory of 692	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	1
PID 3188 wrote to memory of 692	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	1
PID 3188 wrote to memory of 692	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	1
PID 3188 wrote to memory of 692	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	1
PID 3188 wrote to memory of 692	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	1
PID 3188 wrote to memory of 796	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	8
PID 3188 wrote to memory of 796	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	8
PID 3188 wrote to memory of 796	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	8
PID 3188 wrote to memory of 796	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	8
PID 3188 wrote to memory of 796	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	8
PID 3188 wrote to memory of 796	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	8
PID 3188 wrote to memory of 804	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	81
PID 3188 wrote to memory of 804	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	81
PID 3188 wrote to memory of 804	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	81
PID 3188 wrote to memory of 804	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	81
PID 3188 wrote to memory of 804	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	81
PID 3188 wrote to memory of 804	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	81
PID 3188 wrote to memory of 812	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	80
PID 3188 wrote to memory of 812	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	80
PID 3188 wrote to memory of 812	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	80
PID 3188 wrote to memory of 812	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	80
PID 3188 wrote to memory of 812	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	80
PID 3188 wrote to memory of 812	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	80
PID 3188 wrote to memory of 932	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	79
PID 3188 wrote to memory of 932	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	79
PID 3188 wrote to memory of 932	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	79
PID 3188 wrote to memory of 932	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	79
PID 3188 wrote to memory of 932	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	79
PID 3188 wrote to memory of 932	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	79
PID 3188 wrote to memory of 980	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	78
PID 3188 wrote to memory of 980	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	78
PID 3188 wrote to memory of 980	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	78
PID 3188 wrote to memory of 980	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	78
PID 3188 wrote to memory of 980	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	78
PID 3188 wrote to memory of 980	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	78
PID 3188 wrote to memory of 416	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	77
PID 3188 wrote to memory of 416	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	77
PID 3188 wrote to memory of 416	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	77
PID 3188 wrote to memory of 416	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	77
PID 3188 wrote to memory of 416	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	77
PID 3188 wrote to memory of 416	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	77
PID 3188 wrote to memory of 408	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	9
PID 3188 wrote to memory of 408	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	9
PID 3188 wrote to memory of 408	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	9
PID 3188 wrote to memory of 408	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	9
PID 3188 wrote to memory of 408	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	9
PID 3188 wrote to memory of 408	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	9
PID 3188 wrote to memory of 864	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	76
PID 3188 wrote to memory of 864	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	76
PID 3188 wrote to memory of 864	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	76
PID 3188 wrote to memory of 864	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	76
PID 3188 wrote to memory of 864	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	76
PID 3188 wrote to memory of 864	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	76
PID 3188 wrote to memory of 948	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	10
PID 3188 wrote to memory of 948	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	10
PID 3188 wrote to memory of 948	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	10
PID 3188 wrote to memory of 948	3188	54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe	10

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:796
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2172

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5016

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:5044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4440

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3640

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3652

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4416

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3380

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3084

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe
  "C:\Users\Admin\AppData\Local\Temp\54cf571e25364a97a47797184e3e12d0fe2cd74bc291944c5207bdabfa02e39f.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2684

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2620

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2216

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:812
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4248

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3188-133-0x0000000001000000-0x0000000001032000-memory.dmp

Filesize
200KB

Download