16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2

Analysis

max time kernel
91s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
Size

56KB
MD5

000b47c00846ec4a2f9b2ae3113f7f30
SHA1

2bcc327882cfd8b37b119a14a13fd0ed07a6bce6
SHA256

16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2
SHA512

258e702bb2b42374d924c2f093e7b57170b55b322e7004024f5f6c8564f42419fe5567d4c019301b00b273db6fbf6cba52bd86d9b4f6b2a6f522d90abb7d19b8
SSDEEP

768:8tmQTSUlk3Qm4VNIk7EnlldsrHlKfqUp2VrSMV84Ev:2mU2a7EQQCY2VrS

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe:*:enabled:@shell32.dll,-1"	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4036	1208	WerFault.exe	57

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 608	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	4
PID 1208 wrote to memory of 608	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	4
PID 1208 wrote to memory of 608	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	4
PID 1208 wrote to memory of 608	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	4
PID 1208 wrote to memory of 608	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	4
PID 1208 wrote to memory of 608	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	4
PID 1208 wrote to memory of 668	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	2
PID 1208 wrote to memory of 668	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	2
PID 1208 wrote to memory of 668	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	2
PID 1208 wrote to memory of 668	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	2
PID 1208 wrote to memory of 668	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	2
PID 1208 wrote to memory of 668	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	2
PID 1208 wrote to memory of 776	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	8
PID 1208 wrote to memory of 776	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	8
PID 1208 wrote to memory of 776	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	8
PID 1208 wrote to memory of 776	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	8
PID 1208 wrote to memory of 776	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	8
PID 1208 wrote to memory of 776	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	8
PID 1208 wrote to memory of 784	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	76
PID 1208 wrote to memory of 784	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	76
PID 1208 wrote to memory of 784	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	76
PID 1208 wrote to memory of 784	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	76
PID 1208 wrote to memory of 784	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	76
PID 1208 wrote to memory of 784	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	76
PID 1208 wrote to memory of 792	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	75
PID 1208 wrote to memory of 792	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	75
PID 1208 wrote to memory of 792	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	75
PID 1208 wrote to memory of 792	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	75
PID 1208 wrote to memory of 792	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	75
PID 1208 wrote to memory of 792	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	75
PID 1208 wrote to memory of 900	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	9
PID 1208 wrote to memory of 900	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	9
PID 1208 wrote to memory of 900	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	9
PID 1208 wrote to memory of 900	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	9
PID 1208 wrote to memory of 900	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	9
PID 1208 wrote to memory of 900	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	9
PID 1208 wrote to memory of 952	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	74
PID 1208 wrote to memory of 952	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	74
PID 1208 wrote to memory of 952	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	74
PID 1208 wrote to memory of 952	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	74
PID 1208 wrote to memory of 952	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	74
PID 1208 wrote to memory of 952	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	74
PID 1208 wrote to memory of 64	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	10
PID 1208 wrote to memory of 64	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	10
PID 1208 wrote to memory of 64	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	10
PID 1208 wrote to memory of 64	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	10
PID 1208 wrote to memory of 64	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	10
PID 1208 wrote to memory of 64	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	10
PID 1208 wrote to memory of 428	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	11
PID 1208 wrote to memory of 428	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	11
PID 1208 wrote to memory of 428	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	11
PID 1208 wrote to memory of 428	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	11
PID 1208 wrote to memory of 428	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	11
PID 1208 wrote to memory of 428	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	11
PID 1208 wrote to memory of 684	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	12
PID 1208 wrote to memory of 684	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	12
PID 1208 wrote to memory of 684	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	12
PID 1208 wrote to memory of 684	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	12
PID 1208 wrote to memory of 684	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	12
PID 1208 wrote to memory of 684	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	12
PID 1208 wrote to memory of 728	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	73
PID 1208 wrote to memory of 728	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	73
PID 1208 wrote to memory of 728	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	73
PID 1208 wrote to memory of 728	1208	16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe	73

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1104
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:3940
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2440

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4344

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4288

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3840

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3444

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3436

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3376

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2796

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3056
- C:\Users\Admin\AppData\Local\Temp\16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe
  "C:\Users\Admin\AppData\Local\Temp\16d32be15eae4da91ef2d24ee93468789ea37ec4e6a2d4203cb7f82bb9b055b2.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1264
    3⤵
    - Program crash
    PID:4036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2568

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2300

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2096

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:792

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1208 -ip 1208
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-133-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1208-136-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download