5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4

Analysis

max time kernel
120s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
Size

45KB
MD5

2e03bc1deb0caf48e9259ad2185a82f3
SHA1

8e67f461d7133bc78b0b2568bd5f2c9786f05466
SHA256

5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4
SHA512

ee92438b101663cfb1773cc4dc05700c33a5b1d2a59e1a4ae913db92c668382099886849e2b8914d69aa2118db576059a4e1a79d859a1396598afc327a7a681e
SSDEEP

768:StCd2XxviqBjH5sXm7AJxtaR0kvLmq1laFPxTyN8xUk02RutCz:QqCHujJxtaRXvLmOuPxmNWUk4C

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe:*:enabled:@shell32.dll,-1"	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 616	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	77
PID 4804 wrote to memory of 616	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	77
PID 4804 wrote to memory of 616	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	77
PID 4804 wrote to memory of 616	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	77
PID 4804 wrote to memory of 616	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	77
PID 4804 wrote to memory of 616	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	77
PID 4804 wrote to memory of 692	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	1
PID 4804 wrote to memory of 692	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	1
PID 4804 wrote to memory of 692	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	1
PID 4804 wrote to memory of 692	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	1
PID 4804 wrote to memory of 692	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	1
PID 4804 wrote to memory of 692	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	1
PID 4804 wrote to memory of 796	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	3
PID 4804 wrote to memory of 796	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	3
PID 4804 wrote to memory of 796	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	3
PID 4804 wrote to memory of 796	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	3
PID 4804 wrote to memory of 796	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	3
PID 4804 wrote to memory of 796	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	3
PID 4804 wrote to memory of 804	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	76
PID 4804 wrote to memory of 804	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	76
PID 4804 wrote to memory of 804	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	76
PID 4804 wrote to memory of 804	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	76
PID 4804 wrote to memory of 804	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	76
PID 4804 wrote to memory of 804	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	76
PID 4804 wrote to memory of 812	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	75
PID 4804 wrote to memory of 812	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	75
PID 4804 wrote to memory of 812	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	75
PID 4804 wrote to memory of 812	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	75
PID 4804 wrote to memory of 812	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	75
PID 4804 wrote to memory of 812	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	75
PID 4804 wrote to memory of 932	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	74
PID 4804 wrote to memory of 932	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	74
PID 4804 wrote to memory of 932	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	74
PID 4804 wrote to memory of 932	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	74
PID 4804 wrote to memory of 932	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	74
PID 4804 wrote to memory of 932	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	74
PID 4804 wrote to memory of 980	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	73
PID 4804 wrote to memory of 980	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	73
PID 4804 wrote to memory of 980	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	73
PID 4804 wrote to memory of 980	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	73
PID 4804 wrote to memory of 980	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	73
PID 4804 wrote to memory of 980	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	73
PID 4804 wrote to memory of 416	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	4
PID 4804 wrote to memory of 416	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	4
PID 4804 wrote to memory of 416	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	4
PID 4804 wrote to memory of 416	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	4
PID 4804 wrote to memory of 416	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	4
PID 4804 wrote to memory of 416	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	4
PID 4804 wrote to memory of 408	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	72
PID 4804 wrote to memory of 408	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	72
PID 4804 wrote to memory of 408	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	72
PID 4804 wrote to memory of 408	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	72
PID 4804 wrote to memory of 408	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	72
PID 4804 wrote to memory of 408	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	72
PID 4804 wrote to memory of 864	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	71
PID 4804 wrote to memory of 864	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	71
PID 4804 wrote to memory of 864	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	71
PID 4804 wrote to memory of 864	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	71
PID 4804 wrote to memory of 864	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	71
PID 4804 wrote to memory of 864	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	71
PID 4804 wrote to memory of 948	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	70
PID 4804 wrote to memory of 948	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	70
PID 4804 wrote to memory of 948	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	70
PID 4804 wrote to memory of 948	4804	5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe	70

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2172

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4440

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3640

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3652

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4416

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3380

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3084

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe
  "C:\Users\Admin\AppData\Local\Temp\5cb5b1bcfc3e63d55283c383ab6e5555be50246edf35d9a6f8bcd22d6fcd82b4.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2684

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2620

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2216

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:812

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4804-132-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/4804-133-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download