afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96

Analysis

max time kernel
152s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
Size

31KB
MD5

423526d1abd485e4b9b407655ff0d450
SHA1

e818b3a4b0a6b6bf75a7feda6a9f8e8ed483ef95
SHA256

afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96
SHA512

b266ccc1a48793099996bda206e853b8f3b88f181b22d00effcc591061df4d4370d40e8bed9b9b49246a7e5075b93d2387ddb1fe36ad050e7d303d9f27d79a69
SSDEEP

768:KBV6cOdHJ9Mn2I/dt2hNA+fYSzW6wXCT:8V5OdHG7Ft2nA+fRwX

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe:*:enabled:@shell32.dll,-1"	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 592	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	3
PID 804 wrote to memory of 592	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	3
PID 804 wrote to memory of 592	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	3
PID 804 wrote to memory of 592	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	3
PID 804 wrote to memory of 592	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	3
PID 804 wrote to memory of 592	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	3
PID 804 wrote to memory of 660	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	1
PID 804 wrote to memory of 660	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	1
PID 804 wrote to memory of 660	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	1
PID 804 wrote to memory of 660	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	1
PID 804 wrote to memory of 660	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	1
PID 804 wrote to memory of 660	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	1
PID 804 wrote to memory of 772	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	8
PID 804 wrote to memory of 772	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	8
PID 804 wrote to memory of 772	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	8
PID 804 wrote to memory of 772	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	8
PID 804 wrote to memory of 772	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	8
PID 804 wrote to memory of 772	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	8
PID 804 wrote to memory of 784	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	9
PID 804 wrote to memory of 784	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	9
PID 804 wrote to memory of 784	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	9
PID 804 wrote to memory of 784	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	9
PID 804 wrote to memory of 784	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	9
PID 804 wrote to memory of 784	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	9
PID 804 wrote to memory of 792	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	79
PID 804 wrote to memory of 792	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	79
PID 804 wrote to memory of 792	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	79
PID 804 wrote to memory of 792	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	79
PID 804 wrote to memory of 792	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	79
PID 804 wrote to memory of 792	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	79
PID 804 wrote to memory of 896	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	78
PID 804 wrote to memory of 896	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	78
PID 804 wrote to memory of 896	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	78
PID 804 wrote to memory of 896	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	78
PID 804 wrote to memory of 896	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	78
PID 804 wrote to memory of 896	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	78
PID 804 wrote to memory of 944	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	77
PID 804 wrote to memory of 944	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	77
PID 804 wrote to memory of 944	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	77
PID 804 wrote to memory of 944	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	77
PID 804 wrote to memory of 944	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	77
PID 804 wrote to memory of 944	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	77
PID 804 wrote to memory of 312	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	10
PID 804 wrote to memory of 312	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	10
PID 804 wrote to memory of 312	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	10
PID 804 wrote to memory of 312	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	10
PID 804 wrote to memory of 312	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	10
PID 804 wrote to memory of 312	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	10
PID 804 wrote to memory of 524	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	11
PID 804 wrote to memory of 524	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	11
PID 804 wrote to memory of 524	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	11
PID 804 wrote to memory of 524	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	11
PID 804 wrote to memory of 524	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	11
PID 804 wrote to memory of 524	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	11
PID 804 wrote to memory of 680	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	76
PID 804 wrote to memory of 680	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	76
PID 804 wrote to memory of 680	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	76
PID 804 wrote to memory of 680	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	76
PID 804 wrote to memory of 680	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	76
PID 804 wrote to memory of 680	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	76
PID 804 wrote to memory of 808	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	12
PID 804 wrote to memory of 808	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	12
PID 804 wrote to memory of 808	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	12
PID 804 wrote to memory of 808	804	afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe	12

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:592
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:532
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2768
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4420
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:3448
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4404
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3724
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3556
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3460
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3384
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3300

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:940

C:\Users\Admin\AppData\Local\Temp\afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe
"C:\Users\Admin\AppData\Local\Temp\afb746537bacb018c2abbebd7238b4b01e4628c830063a6f736a944abcc7bb96.exe"
1⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2724

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2580

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2520

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1828

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-132-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download