8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
Size

45KB
MD5

645f5d7f3dde0334cf7aaa8fa363d640
SHA1

6e132afcac630104b85177c9bbd8941a49addaf8
SHA256

8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62
SHA512

b116c48409813ce22f242e1a2129e83f7d8b7306a9b4cba4ede0b581e1044748ee6c750255b43576c5d97848aaa2c19f9ef4a451a0cfd3baea98f3c042c922cc
SSDEEP

768:+tCd2XxviqBjHH74CFgHBYaFENvXQb++zf+6uMlWN/Tw:MqCHHcVHqCAvwf+X/k

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe:*:enabled:@shell32.dll,-1"	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 608	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	4
PID 2520 wrote to memory of 608	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	4
PID 2520 wrote to memory of 608	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	4
PID 2520 wrote to memory of 608	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	4
PID 2520 wrote to memory of 608	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	4
PID 2520 wrote to memory of 608	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	4
PID 2520 wrote to memory of 672	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	2
PID 2520 wrote to memory of 672	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	2
PID 2520 wrote to memory of 672	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	2
PID 2520 wrote to memory of 672	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	2
PID 2520 wrote to memory of 672	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	2
PID 2520 wrote to memory of 672	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	2
PID 2520 wrote to memory of 780	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	8
PID 2520 wrote to memory of 780	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	8
PID 2520 wrote to memory of 780	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	8
PID 2520 wrote to memory of 780	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	8
PID 2520 wrote to memory of 780	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	8
PID 2520 wrote to memory of 780	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	8
PID 2520 wrote to memory of 788	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	80
PID 2520 wrote to memory of 788	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	80
PID 2520 wrote to memory of 788	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	80
PID 2520 wrote to memory of 788	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	80
PID 2520 wrote to memory of 788	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	80
PID 2520 wrote to memory of 788	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	80
PID 2520 wrote to memory of 796	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	79
PID 2520 wrote to memory of 796	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	79
PID 2520 wrote to memory of 796	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	79
PID 2520 wrote to memory of 796	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	79
PID 2520 wrote to memory of 796	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	79
PID 2520 wrote to memory of 796	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	79
PID 2520 wrote to memory of 904	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	78
PID 2520 wrote to memory of 904	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	78
PID 2520 wrote to memory of 904	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	78
PID 2520 wrote to memory of 904	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	78
PID 2520 wrote to memory of 904	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	78
PID 2520 wrote to memory of 904	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	78
PID 2520 wrote to memory of 948	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	77
PID 2520 wrote to memory of 948	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	77
PID 2520 wrote to memory of 948	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	77
PID 2520 wrote to memory of 948	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	77
PID 2520 wrote to memory of 948	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	77
PID 2520 wrote to memory of 948	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	77
PID 2520 wrote to memory of 64	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	9
PID 2520 wrote to memory of 64	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	9
PID 2520 wrote to memory of 64	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	9
PID 2520 wrote to memory of 64	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	9
PID 2520 wrote to memory of 64	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	9
PID 2520 wrote to memory of 64	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	9
PID 2520 wrote to memory of 508	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	76
PID 2520 wrote to memory of 508	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	76
PID 2520 wrote to memory of 508	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	76
PID 2520 wrote to memory of 508	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	76
PID 2520 wrote to memory of 508	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	76
PID 2520 wrote to memory of 508	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	76
PID 2520 wrote to memory of 656	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	75
PID 2520 wrote to memory of 656	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	75
PID 2520 wrote to memory of 656	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	75
PID 2520 wrote to memory of 656	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	75
PID 2520 wrote to memory of 656	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	75
PID 2520 wrote to memory of 656	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	75
PID 2520 wrote to memory of 920	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	74
PID 2520 wrote to memory of 920	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	74
PID 2520 wrote to memory of 920	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	74
PID 2520 wrote to memory of 920	2520	8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe	74

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1108
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3432

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4604

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3700

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3936

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3100

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4644

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4440

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3684

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3368

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1708

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:684
- C:\Users\Admin\AppData\Local\Temp\8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe
  "C:\Users\Admin\AppData\Local\Temp\8e1675d6c8145c57f016548bb586403e37abe556ac5397b0a56663c1e9befb62.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2820

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2416

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1700

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-132-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download
memory/2520-133-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download
memory/2520-134-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download