28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Size

151KB
MD5

4d705f90a9d39101f36ee3befe3b1a80
SHA1

375bbddd2110026c95987832284c25927293f27c
SHA256

28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49
SHA512

c72f65bc4e59ce12b84a15943e14fc1a53c8f75366daa6e6c2d1205533f7cc659fdf40916d228834293efadcdbb313a2f990d9a00715ec7c1096918a77b36d39
SSDEEP

3072:XL/Rr46odCwyomuakgFM6T4x4iycCzI31z0RQkjZ6Vk1DSioyQ1c:726oSFo4fI35S6Vk1GioyQ

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe:*:enabled:@shell32.dll,-1"	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec\protocol\StdExecute	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec\protocol\StdExecute\server\ = "sndrec32.exe"	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec\protocol\StdFileEditing\server	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec\protocol\StdFileEditing	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec\protocol\StdFileEditing\server\ = "sndrec32.exe"	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec\protocol\StdExecute\server	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec\protocol	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 588	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	77
PID 216 wrote to memory of 588	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	77
PID 216 wrote to memory of 588	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	77
PID 216 wrote to memory of 588	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	77
PID 216 wrote to memory of 588	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	77
PID 216 wrote to memory of 588	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	77
PID 216 wrote to memory of 664	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	75
PID 216 wrote to memory of 664	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	75
PID 216 wrote to memory of 664	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	75
PID 216 wrote to memory of 664	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	75
PID 216 wrote to memory of 664	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	75
PID 216 wrote to memory of 664	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	75
PID 216 wrote to memory of 772	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	74
PID 216 wrote to memory of 772	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	74
PID 216 wrote to memory of 772	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	74
PID 216 wrote to memory of 772	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	74
PID 216 wrote to memory of 772	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	74
PID 216 wrote to memory of 772	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	74
PID 216 wrote to memory of 776	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	73
PID 216 wrote to memory of 776	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	73
PID 216 wrote to memory of 776	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	73
PID 216 wrote to memory of 776	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	73
PID 216 wrote to memory of 776	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	73
PID 216 wrote to memory of 776	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	73
PID 216 wrote to memory of 788	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	72
PID 216 wrote to memory of 788	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	72
PID 216 wrote to memory of 788	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	72
PID 216 wrote to memory of 788	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	72
PID 216 wrote to memory of 788	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	72
PID 216 wrote to memory of 788	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	72
PID 216 wrote to memory of 900	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	71
PID 216 wrote to memory of 900	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	71
PID 216 wrote to memory of 900	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	71
PID 216 wrote to memory of 900	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	71
PID 216 wrote to memory of 900	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	71
PID 216 wrote to memory of 900	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	71
PID 216 wrote to memory of 952	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	70
PID 216 wrote to memory of 952	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	70
PID 216 wrote to memory of 952	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	70
PID 216 wrote to memory of 952	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	70
PID 216 wrote to memory of 952	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	70
PID 216 wrote to memory of 952	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	70
PID 216 wrote to memory of 328	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	1
PID 216 wrote to memory of 328	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	1
PID 216 wrote to memory of 328	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	1
PID 216 wrote to memory of 328	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	1
PID 216 wrote to memory of 328	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	1
PID 216 wrote to memory of 328	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	1
PID 216 wrote to memory of 444	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	2
PID 216 wrote to memory of 444	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	2
PID 216 wrote to memory of 444	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	2
PID 216 wrote to memory of 444	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	2
PID 216 wrote to memory of 444	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	2
PID 216 wrote to memory of 444	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	2
PID 216 wrote to memory of 408	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	69
PID 216 wrote to memory of 408	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	69
PID 216 wrote to memory of 408	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	69
PID 216 wrote to memory of 408	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	69
PID 216 wrote to memory of 408	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	69
PID 216 wrote to memory of 408	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	69
PID 216 wrote to memory of 860	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	68
PID 216 wrote to memory of 860	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	68
PID 216 wrote to memory of 860	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	68
PID 216 wrote to memory of 860	216	28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe	68

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2464

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3812

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1896

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1448

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5060

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4612

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4360

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3680

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3544

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3384

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:652
- C:\Users\Admin\AppData\Local\Temp\28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe
  "C:\Users\Admin\AppData\Local\Temp\28568551573992769ba2befe832d47ef773e8b83ce68aed0cad9868a66db2a49.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2824

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2576

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2068

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-132-0x0000000001000000-0x0000000001029000-memory.dmp

Filesize
164KB

Download
memory/216-133-0x0000000001000000-0x0000000001029000-memory.dmp

Filesize
164KB

Download