22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
Size

56KB
MD5

3413fc55ed52571ff164ff15d1d48830
SHA1

d3b17ca36dd29eebc71385eb2c73c7319ff95ec9
SHA256

22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d
SHA512

bef5d033c5419fb5befe6f81504e133ad0d8f3bb6ed927613e218ac5828f8d3c5d3a1809d3b593bc3ab973980e05571720df7910768da1d13e613ccaa7c8109c
SSDEEP

768:1r9g14j+T3998k2dJ9OqbUeQqcl8YnBXraP8UtDuaaj1H7u/qOwwJyIT1Lnxe8i:gkiRkYBXrGjaRH7uCOvbc

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe:*:enabled:@shell32.dll,-1"	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 588	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	80
PID 384 wrote to memory of 588	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	80
PID 384 wrote to memory of 588	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	80
PID 384 wrote to memory of 588	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	80
PID 384 wrote to memory of 588	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	80
PID 384 wrote to memory of 588	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	80
PID 384 wrote to memory of 668	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	78
PID 384 wrote to memory of 668	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	78
PID 384 wrote to memory of 668	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	78
PID 384 wrote to memory of 668	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	78
PID 384 wrote to memory of 668	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	78
PID 384 wrote to memory of 668	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	78
PID 384 wrote to memory of 776	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	1
PID 384 wrote to memory of 776	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	1
PID 384 wrote to memory of 776	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	1
PID 384 wrote to memory of 776	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	1
PID 384 wrote to memory of 776	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	1
PID 384 wrote to memory of 776	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	1
PID 384 wrote to memory of 788	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	77
PID 384 wrote to memory of 788	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	77
PID 384 wrote to memory of 788	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	77
PID 384 wrote to memory of 788	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	77
PID 384 wrote to memory of 788	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	77
PID 384 wrote to memory of 788	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	77
PID 384 wrote to memory of 792	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	76
PID 384 wrote to memory of 792	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	76
PID 384 wrote to memory of 792	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	76
PID 384 wrote to memory of 792	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	76
PID 384 wrote to memory of 792	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	76
PID 384 wrote to memory of 792	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	76
PID 384 wrote to memory of 888	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	75
PID 384 wrote to memory of 888	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	75
PID 384 wrote to memory of 888	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	75
PID 384 wrote to memory of 888	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	75
PID 384 wrote to memory of 888	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	75
PID 384 wrote to memory of 888	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	75
PID 384 wrote to memory of 940	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	74
PID 384 wrote to memory of 940	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	74
PID 384 wrote to memory of 940	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	74
PID 384 wrote to memory of 940	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	74
PID 384 wrote to memory of 940	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	74
PID 384 wrote to memory of 940	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	74
PID 384 wrote to memory of 1020	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	2
PID 384 wrote to memory of 1020	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	2
PID 384 wrote to memory of 1020	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	2
PID 384 wrote to memory of 1020	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	2
PID 384 wrote to memory of 1020	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	2
PID 384 wrote to memory of 1020	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	2
PID 384 wrote to memory of 476	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	3
PID 384 wrote to memory of 476	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	3
PID 384 wrote to memory of 476	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	3
PID 384 wrote to memory of 476	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	3
PID 384 wrote to memory of 476	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	3
PID 384 wrote to memory of 476	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	3
PID 384 wrote to memory of 536	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	73
PID 384 wrote to memory of 536	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	73
PID 384 wrote to memory of 536	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	73
PID 384 wrote to memory of 536	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	73
PID 384 wrote to memory of 536	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	73
PID 384 wrote to memory of 536	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	73
PID 384 wrote to memory of 652	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	4
PID 384 wrote to memory of 652	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	4
PID 384 wrote to memory of 652	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	4
PID 384 wrote to memory of 652	384	22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe	4

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:776
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3456
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3000
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:2428
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2320
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1824
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:3924
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4620
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3764
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3572
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3424
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3356
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3252

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2740

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2440
- C:\Users\Admin\AppData\Local\Temp\22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe
  "C:\Users\Admin\AppData\Local\Temp\22b3503c8cee5432fe1703e74f79c56081326f3c3433a6a75d26429e6596856d.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2536

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2360

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:888

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-132-0x0000000001000000-0x0000000001013000-memory.dmp

Filesize
76KB

Download
memory/384-133-0x0000000001000000-0x0000000001013000-memory.dmp

Filesize
76KB

Download