8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
Size

50KB
MD5

423d463e7a06afe18d2138cc3a639520
SHA1

3d48cb93e5e9a09d881b1b76b3b0efe3d9b9491f
SHA256

8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03
SHA512

545aec11c89ddd8efc280ced053b8b9341cf2f9cbb477601b41bab9b03495609e87de439dcf52b9741760fb0817b3a05931328bac83a6001539e63288d8e0b67
SSDEEP

1536:wTrByx5F4qNwtqKiE/nDCO5cBoJbjfhtZqUWOF:2rErF4q6qKiE/n2OCub9t8

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe:*:enabled:@shell32.dll,-1"	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 620	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	3
PID 2692 wrote to memory of 620	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	3
PID 2692 wrote to memory of 620	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	3
PID 2692 wrote to memory of 620	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	3
PID 2692 wrote to memory of 620	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	3
PID 2692 wrote to memory of 620	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	3
PID 2692 wrote to memory of 668	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	1
PID 2692 wrote to memory of 668	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	1
PID 2692 wrote to memory of 668	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	1
PID 2692 wrote to memory of 668	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	1
PID 2692 wrote to memory of 668	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	1
PID 2692 wrote to memory of 668	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	1
PID 2692 wrote to memory of 776	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	42
PID 2692 wrote to memory of 776	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	42
PID 2692 wrote to memory of 776	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	42
PID 2692 wrote to memory of 776	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	42
PID 2692 wrote to memory of 776	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	42
PID 2692 wrote to memory of 776	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	42
PID 2692 wrote to memory of 784	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	41
PID 2692 wrote to memory of 784	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	41
PID 2692 wrote to memory of 784	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	41
PID 2692 wrote to memory of 784	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	41
PID 2692 wrote to memory of 784	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	41
PID 2692 wrote to memory of 784	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	41
PID 2692 wrote to memory of 792	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	40
PID 2692 wrote to memory of 792	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	40
PID 2692 wrote to memory of 792	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	40
PID 2692 wrote to memory of 792	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	40
PID 2692 wrote to memory of 792	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	40
PID 2692 wrote to memory of 792	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	40
PID 2692 wrote to memory of 896	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	39
PID 2692 wrote to memory of 896	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	39
PID 2692 wrote to memory of 896	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	39
PID 2692 wrote to memory of 896	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	39
PID 2692 wrote to memory of 896	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	39
PID 2692 wrote to memory of 896	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	39
PID 2692 wrote to memory of 948	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	38
PID 2692 wrote to memory of 948	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	38
PID 2692 wrote to memory of 948	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	38
PID 2692 wrote to memory of 948	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	38
PID 2692 wrote to memory of 948	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	38
PID 2692 wrote to memory of 948	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	38
PID 2692 wrote to memory of 1020	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	8
PID 2692 wrote to memory of 1020	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	8
PID 2692 wrote to memory of 1020	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	8
PID 2692 wrote to memory of 1020	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	8
PID 2692 wrote to memory of 1020	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	8
PID 2692 wrote to memory of 1020	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	8
PID 2692 wrote to memory of 484	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	37
PID 2692 wrote to memory of 484	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	37
PID 2692 wrote to memory of 484	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	37
PID 2692 wrote to memory of 484	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	37
PID 2692 wrote to memory of 484	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	37
PID 2692 wrote to memory of 484	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	37
PID 2692 wrote to memory of 400	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	9
PID 2692 wrote to memory of 400	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	9
PID 2692 wrote to memory of 400	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	9
PID 2692 wrote to memory of 400	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	9
PID 2692 wrote to memory of 400	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	9
PID 2692 wrote to memory of 400	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	9
PID 2692 wrote to memory of 656	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	36
PID 2692 wrote to memory of 656	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	36
PID 2692 wrote to memory of 656	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	36
PID 2692 wrote to memory of 656	2692	8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe	36

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1124
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1916

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:792
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3432
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3712
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4740
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4688
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4276
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3720
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3520
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3364
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3260

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:8

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3036
- C:\Users\Admin\AppData\Local\Temp\8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe
  "C:\Users\Admin\AppData\Local\Temp\8e74c1ef598d22779d8fb4b9f491c9de38ff50de5e14cbe05e7e12331bcadc03.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2652

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-132-0x0000000001000000-0x0000000001011000-memory.dmp

Filesize
68KB

Download
memory/2692-133-0x0000000001000000-0x0000000001011000-memory.dmp

Filesize
68KB

Download