ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
Size

144KB
MD5

13efe2f21dcf4a31a32e62996b281420
SHA1

e4ea631cb0571ff7637686dbb10c2e4d8ad7bbcf
SHA256

ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb
SHA512

77f2875578225a479ab0a3ce3acac37a9133ee41dc18ee6e1f8800265d48d59463b05e31577956df6f984d625c2c70ec9ad95fb1b48e89fce9a7415dd06116db
SSDEEP

3072:bCt6U7tTSlHTTujesV9xh7xeQhzidyyoZOr9hcD6a2I:uxtTMToxh7Fyy1CaF

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe:*:enabled:@shell32.dll,-1"	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPlayer\ = "媒体剪辑"	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0003000E-0000-0000-C000-000000000046}	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
Token: 33	4104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4104	AUDIODG.EXE

Suspicious use of SetWindowsHookAW 1 IoCs

pid	Process
4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 588	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	5
PID 4316 wrote to memory of 588	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	5
PID 4316 wrote to memory of 588	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	5
PID 4316 wrote to memory of 588	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	5
PID 4316 wrote to memory of 588	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	5
PID 4316 wrote to memory of 588	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	5
PID 4316 wrote to memory of 664	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	3
PID 4316 wrote to memory of 664	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	3
PID 4316 wrote to memory of 664	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	3
PID 4316 wrote to memory of 664	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	3
PID 4316 wrote to memory of 664	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	3
PID 4316 wrote to memory of 664	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	3
PID 4316 wrote to memory of 772	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	81
PID 4316 wrote to memory of 772	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	81
PID 4316 wrote to memory of 772	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	81
PID 4316 wrote to memory of 772	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	81
PID 4316 wrote to memory of 772	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	81
PID 4316 wrote to memory of 772	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	81
PID 4316 wrote to memory of 776	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	13
PID 4316 wrote to memory of 776	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	13
PID 4316 wrote to memory of 776	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	13
PID 4316 wrote to memory of 776	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	13
PID 4316 wrote to memory of 776	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	13
PID 4316 wrote to memory of 776	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	13
PID 4316 wrote to memory of 788	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	11
PID 4316 wrote to memory of 788	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	11
PID 4316 wrote to memory of 788	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	11
PID 4316 wrote to memory of 788	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	11
PID 4316 wrote to memory of 788	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	11
PID 4316 wrote to memory of 788	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	11
PID 4316 wrote to memory of 900	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	10
PID 4316 wrote to memory of 900	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	10
PID 4316 wrote to memory of 900	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	10
PID 4316 wrote to memory of 900	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	10
PID 4316 wrote to memory of 900	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	10
PID 4316 wrote to memory of 900	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	10
PID 4316 wrote to memory of 952	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	8
PID 4316 wrote to memory of 952	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	8
PID 4316 wrote to memory of 952	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	8
PID 4316 wrote to memory of 952	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	8
PID 4316 wrote to memory of 952	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	8
PID 4316 wrote to memory of 952	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	8
PID 4316 wrote to memory of 328	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	9
PID 4316 wrote to memory of 328	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	9
PID 4316 wrote to memory of 328	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	9
PID 4316 wrote to memory of 328	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	9
PID 4316 wrote to memory of 328	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	9
PID 4316 wrote to memory of 328	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	9
PID 4316 wrote to memory of 444	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	12
PID 4316 wrote to memory of 444	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	12
PID 4316 wrote to memory of 444	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	12
PID 4316 wrote to memory of 444	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	12
PID 4316 wrote to memory of 444	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	12
PID 4316 wrote to memory of 444	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	12
PID 4316 wrote to memory of 408	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	80
PID 4316 wrote to memory of 408	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	80
PID 4316 wrote to memory of 408	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	80
PID 4316 wrote to memory of 408	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	80
PID 4316 wrote to memory of 408	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	80
PID 4316 wrote to memory of 408	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	80
PID 4316 wrote to memory of 860	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	14
PID 4316 wrote to memory of 860	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	14
PID 4316 wrote to memory of 860	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	14
PID 4316 wrote to memory of 860	4316	ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe	14

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:328
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3444
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4156
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1448
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4412
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4612
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4360
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3680
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3544
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3384
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1684
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x4f0 0x4a0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:652
- C:\Users\Admin\AppData\Local\Temp\ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe
  "C:\Users\Admin\AppData\Local\Temp\ce150d02df1ec9267da28014904729d0a3852408deea225fe776cc5ce20738bb.exe"
  2⤵
  - Modifies firewall policy service
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookAW
  - Suspicious use of WriteProcessMemory
  PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2824

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2576

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2068

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:408

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4316-132-0x0000000001000000-0x000000000102E000-memory.dmp

Filesize
184KB

Download
memory/4316-133-0x0000000001000000-0x000000000102E000-memory.dmp

Filesize
184KB

Download