bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f

Analysis

max time kernel
195s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
Size

155KB
MD5

6d493c24011ff680060dcafb0bde5570
SHA1

33b8fea7af99881c84d5817375391bdabbeeadbf
SHA256

bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f
SHA512

4cb85f31a7aab3bb6bc7a21715cf1575b2c2ae8e466bfff7050a78bbbda8d6d15cb1e482f501baa3d9e8926a9fa4df96994ad9e07599d95955e1b7e2062a6858
SSDEEP

3072:pkVDaBSqao9c3HwsanTdgyOxsP+f+Pkj5uP/p6VeMX:rSqjc3HsTaxoqvjoHp6VeM

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe:*:enabled:@shell32.dll,-1"	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	2320	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 588	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	5
PID 2320 wrote to memory of 588	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	5
PID 2320 wrote to memory of 588	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	5
PID 2320 wrote to memory of 588	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	5
PID 2320 wrote to memory of 588	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	5
PID 2320 wrote to memory of 588	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	5
PID 2320 wrote to memory of 668	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	3
PID 2320 wrote to memory of 668	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	3
PID 2320 wrote to memory of 668	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	3
PID 2320 wrote to memory of 668	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	3
PID 2320 wrote to memory of 668	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	3
PID 2320 wrote to memory of 668	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	3
PID 2320 wrote to memory of 772	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	8
PID 2320 wrote to memory of 772	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	8
PID 2320 wrote to memory of 772	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	8
PID 2320 wrote to memory of 772	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	8
PID 2320 wrote to memory of 772	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	8
PID 2320 wrote to memory of 772	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	8
PID 2320 wrote to memory of 780	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	14
PID 2320 wrote to memory of 780	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	14
PID 2320 wrote to memory of 780	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	14
PID 2320 wrote to memory of 780	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	14
PID 2320 wrote to memory of 780	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	14
PID 2320 wrote to memory of 780	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	14
PID 2320 wrote to memory of 788	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	12
PID 2320 wrote to memory of 788	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	12
PID 2320 wrote to memory of 788	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	12
PID 2320 wrote to memory of 788	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	12
PID 2320 wrote to memory of 788	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	12
PID 2320 wrote to memory of 788	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	12
PID 2320 wrote to memory of 896	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	11
PID 2320 wrote to memory of 896	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	11
PID 2320 wrote to memory of 896	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	11
PID 2320 wrote to memory of 896	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	11
PID 2320 wrote to memory of 896	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	11
PID 2320 wrote to memory of 896	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	11
PID 2320 wrote to memory of 948	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	10
PID 2320 wrote to memory of 948	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	10
PID 2320 wrote to memory of 948	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	10
PID 2320 wrote to memory of 948	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	10
PID 2320 wrote to memory of 948	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	10
PID 2320 wrote to memory of 948	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	10
PID 2320 wrote to memory of 1020	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	9
PID 2320 wrote to memory of 1020	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	9
PID 2320 wrote to memory of 1020	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	9
PID 2320 wrote to memory of 1020	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	9
PID 2320 wrote to memory of 1020	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	9
PID 2320 wrote to memory of 1020	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	9
PID 2320 wrote to memory of 384	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	13
PID 2320 wrote to memory of 384	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	13
PID 2320 wrote to memory of 384	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	13
PID 2320 wrote to memory of 384	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	13
PID 2320 wrote to memory of 384	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	13
PID 2320 wrote to memory of 384	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	13
PID 2320 wrote to memory of 416	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	15
PID 2320 wrote to memory of 416	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	15
PID 2320 wrote to memory of 416	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	15
PID 2320 wrote to memory of 416	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	15
PID 2320 wrote to memory of 416	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	15
PID 2320 wrote to memory of 416	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	15
PID 2320 wrote to memory of 836	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	19
PID 2320 wrote to memory of 836	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	19
PID 2320 wrote to memory of 836	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	19
PID 2320 wrote to memory of 836	2320	bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe	19

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3432
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1604
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4764
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4960
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2820
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4612
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3976
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3708
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3520
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3368
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:384

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1076
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2736

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2456
- C:\Users\Admin\AppData\Local\Temp\bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe
  "C:\Users\Admin\AppData\Local\Temp\bd5b26ec9f94f2eb3efe0365e1f75ff756d4542f627144edfa019da93dfaba3f.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 392
    3⤵
    - Program crash
    PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2552

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2368

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2236

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2320 -ip 2320
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-132-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2320-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download