53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc

Analysis

max time kernel
91s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
Size

222KB
MD5

04610a155911e70cb3dc4d9fade67220
SHA1

4c52cbf1d8883c544a29eafe5c9c8272b0f3ea58
SHA256

53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc
SHA512

9f44c9e8412bea9424e16ac0e73e8d75afe3fc73df60132136cd5674977d3536511052776fc1173c649a5703f775c4e813f654ebe7ee5ac0a06365dd7aae504d
SSDEEP

6144:FAPNe0dMTeWja3tcn9XK/SpSP6KkM1Kw:50dMTeWm9ea/SpSdb1

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe:*:enabled:@shell32.dll,-1"	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	1884	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 616	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	3
PID 1884 wrote to memory of 616	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	3
PID 1884 wrote to memory of 616	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	3
PID 1884 wrote to memory of 616	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	3
PID 1884 wrote to memory of 616	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	3
PID 1884 wrote to memory of 616	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	3
PID 1884 wrote to memory of 692	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	1
PID 1884 wrote to memory of 692	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	1
PID 1884 wrote to memory of 692	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	1
PID 1884 wrote to memory of 692	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	1
PID 1884 wrote to memory of 692	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	1
PID 1884 wrote to memory of 692	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	1
PID 1884 wrote to memory of 796	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	8
PID 1884 wrote to memory of 796	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	8
PID 1884 wrote to memory of 796	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	8
PID 1884 wrote to memory of 796	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	8
PID 1884 wrote to memory of 796	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	8
PID 1884 wrote to memory of 796	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	8
PID 1884 wrote to memory of 804	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	81
PID 1884 wrote to memory of 804	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	81
PID 1884 wrote to memory of 804	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	81
PID 1884 wrote to memory of 804	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	81
PID 1884 wrote to memory of 804	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	81
PID 1884 wrote to memory of 804	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	81
PID 1884 wrote to memory of 812	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	80
PID 1884 wrote to memory of 812	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	80
PID 1884 wrote to memory of 812	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	80
PID 1884 wrote to memory of 812	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	80
PID 1884 wrote to memory of 812	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	80
PID 1884 wrote to memory of 812	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	80
PID 1884 wrote to memory of 932	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	79
PID 1884 wrote to memory of 932	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	79
PID 1884 wrote to memory of 932	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	79
PID 1884 wrote to memory of 932	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	79
PID 1884 wrote to memory of 932	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	79
PID 1884 wrote to memory of 932	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	79
PID 1884 wrote to memory of 980	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	78
PID 1884 wrote to memory of 980	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	78
PID 1884 wrote to memory of 980	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	78
PID 1884 wrote to memory of 980	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	78
PID 1884 wrote to memory of 980	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	78
PID 1884 wrote to memory of 980	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	78
PID 1884 wrote to memory of 416	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	9
PID 1884 wrote to memory of 416	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	9
PID 1884 wrote to memory of 416	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	9
PID 1884 wrote to memory of 416	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	9
PID 1884 wrote to memory of 416	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	9
PID 1884 wrote to memory of 416	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	9
PID 1884 wrote to memory of 408	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	10
PID 1884 wrote to memory of 408	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	10
PID 1884 wrote to memory of 408	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	10
PID 1884 wrote to memory of 408	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	10
PID 1884 wrote to memory of 408	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	10
PID 1884 wrote to memory of 408	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	10
PID 1884 wrote to memory of 864	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	77
PID 1884 wrote to memory of 864	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	77
PID 1884 wrote to memory of 864	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	77
PID 1884 wrote to memory of 864	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	77
PID 1884 wrote to memory of 864	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	77
PID 1884 wrote to memory of 864	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	77
PID 1884 wrote to memory of 948	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	11
PID 1884 wrote to memory of 948	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	11
PID 1884 wrote to memory of 948	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	11
PID 1884 wrote to memory of 948	1884	53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe	11

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:796
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3652

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2432

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1664

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1884 -ip 1884
  2⤵
  PID:4500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4440

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3640

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1396

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3084

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe
  "C:\Users\Admin\AppData\Local\Temp\53b0a3c36a7e606145d0559d38545d609b38ca7fa8a84ef7e6237dc2d4ec3bcc.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 572
    3⤵
    - Program crash
    PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2684

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2172

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:812
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4684

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-132-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1884-133-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download