161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
Size 219KB
Sample221010-3bp2cadfg5
SHA256 161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6
MD5 25cf1547bd7079a8f8cc85c3dedf4961
SHA1 5c919053ce568c3955b3cf39f7ed8d5efeb40c84
SHA512 b268fe207b1ef0ae562d4411fa887c5a1f1d0c568e1b7a7267e41fe494a764827a62c303bd36dc262d3bbcb2daea6b4e7329d4a5dd4e41b3d4ab599a7c407783
SSDEEP 3072:Hfm7pV2aD2xG0i6ywwA/tlmI85/fRbK8zHPprd6VAIhPi64MZnmznD:YX9203AbmI85NBB6V5PpTmzD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe:*:enabled:@shell32.dll,-1"	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 588	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	8
PID 388 wrote to memory of 588	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	8
PID 388 wrote to memory of 588	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	8
PID 388 wrote to memory of 588	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	8
PID 388 wrote to memory of 588	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	8
PID 388 wrote to memory of 588	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	8
PID 388 wrote to memory of 672	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	4
PID 388 wrote to memory of 672	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	4
PID 388 wrote to memory of 672	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	4
PID 388 wrote to memory of 672	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	4
PID 388 wrote to memory of 672	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	4
PID 388 wrote to memory of 672	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	4
PID 388 wrote to memory of 772	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	6
PID 388 wrote to memory of 772	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	6
PID 388 wrote to memory of 772	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	6
PID 388 wrote to memory of 772	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	6
PID 388 wrote to memory of 772	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	6
PID 388 wrote to memory of 772	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	6
PID 388 wrote to memory of 780	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	5
PID 388 wrote to memory of 780	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	5
PID 388 wrote to memory of 780	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	5
PID 388 wrote to memory of 780	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	5
PID 388 wrote to memory of 780	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	5
PID 388 wrote to memory of 780	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	5
PID 388 wrote to memory of 788	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	13
PID 388 wrote to memory of 788	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	13
PID 388 wrote to memory of 788	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	13
PID 388 wrote to memory of 788	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	13
PID 388 wrote to memory of 788	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	13
PID 388 wrote to memory of 788	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	13
PID 388 wrote to memory of 888	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	12
PID 388 wrote to memory of 888	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	12
PID 388 wrote to memory of 888	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	12
PID 388 wrote to memory of 888	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	12
PID 388 wrote to memory of 888	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	12
PID 388 wrote to memory of 888	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	12
PID 388 wrote to memory of 940	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	11
PID 388 wrote to memory of 940	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	11
PID 388 wrote to memory of 940	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	11
PID 388 wrote to memory of 940	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	11
PID 388 wrote to memory of 940	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	11
PID 388 wrote to memory of 940	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	11
PID 388 wrote to memory of 1016	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	10
PID 388 wrote to memory of 1016	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	10
PID 388 wrote to memory of 1016	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	10
PID 388 wrote to memory of 1016	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	10
PID 388 wrote to memory of 1016	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	10
PID 388 wrote to memory of 1016	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	10
PID 388 wrote to memory of 484	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	14
PID 388 wrote to memory of 484	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	14
PID 388 wrote to memory of 484	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	14
PID 388 wrote to memory of 484	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	14
PID 388 wrote to memory of 484	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	14
PID 388 wrote to memory of 484	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	14
PID 388 wrote to memory of 424	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	15
PID 388 wrote to memory of 424	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	15
PID 388 wrote to memory of 424	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	15
PID 388 wrote to memory of 424	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	15
PID 388 wrote to memory of 424	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	15
PID 388 wrote to memory of 424	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	15
PID 388 wrote to memory of 904	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	80
PID 388 wrote to memory of 904	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	80
PID 388 wrote to memory of 904	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	80
PID 388 wrote to memory of 904	388	161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe	80

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3524
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3444
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3376
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3292
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4988
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4396
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:3344
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4852
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3888
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3608
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3536

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:888

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1124
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2724
- C:\Users\Admin\AppData\Local\Temp\161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe
  "C:\Users\Admin\AppData\Local\Temp\161f911a3e8df12dfe4a25a18b93238d1118b7b487793a3344545ec03fe34ee6.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2616

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2376

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-132-0x0000000000400000-0x000000000048E000-memory.dmp

Download

memory/388-133-0x0000000000400000-0x000000000048E000-memory.dmp

Download