60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
Size

600KB
MD5

962e8053f9c45963e21f2eea465c7c00
SHA1

f3d0be26803b2c2502626ef88a201feb6956b3e2
SHA256

60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3
SHA512

07361835a768c03dc8588a0f5eeed2ea0659be22c477f7c7809cce68fd6df3ccc6081fc0d70822609dda69e6a69a7d315e3e5f2db71629a26a388ced5ae41a0a
SSDEEP

12288:M7Tg15v8XS3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7zj:kcXvWS3/kRc4l6g6gtPbcHn7qkj

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe:*:enabled:@shell32.dll,-1"	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 624	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	3
PID 764 wrote to memory of 624	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	3
PID 764 wrote to memory of 624	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	3
PID 764 wrote to memory of 624	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	3
PID 764 wrote to memory of 624	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	3
PID 764 wrote to memory of 624	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	3
PID 764 wrote to memory of 680	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	2
PID 764 wrote to memory of 680	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	2
PID 764 wrote to memory of 680	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	2
PID 764 wrote to memory of 680	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	2
PID 764 wrote to memory of 680	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	2
PID 764 wrote to memory of 680	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	2
PID 764 wrote to memory of 788	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	10
PID 764 wrote to memory of 788	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	10
PID 764 wrote to memory of 788	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	10
PID 764 wrote to memory of 788	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	10
PID 764 wrote to memory of 788	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	10
PID 764 wrote to memory of 788	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	10
PID 764 wrote to memory of 804	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	8
PID 764 wrote to memory of 804	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	8
PID 764 wrote to memory of 804	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	8
PID 764 wrote to memory of 804	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	8
PID 764 wrote to memory of 804	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	8
PID 764 wrote to memory of 804	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	8
PID 764 wrote to memory of 800	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	9
PID 764 wrote to memory of 800	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	9
PID 764 wrote to memory of 800	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	9
PID 764 wrote to memory of 800	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	9
PID 764 wrote to memory of 800	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	9
PID 764 wrote to memory of 800	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	9
PID 764 wrote to memory of 912	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	78
PID 764 wrote to memory of 912	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	78
PID 764 wrote to memory of 912	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	78
PID 764 wrote to memory of 912	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	78
PID 764 wrote to memory of 912	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	78
PID 764 wrote to memory of 912	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	78
PID 764 wrote to memory of 960	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	77
PID 764 wrote to memory of 960	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	77
PID 764 wrote to memory of 960	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	77
PID 764 wrote to memory of 960	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	77
PID 764 wrote to memory of 960	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	77
PID 764 wrote to memory of 960	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	77
PID 764 wrote to memory of 60	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	11
PID 764 wrote to memory of 60	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	11
PID 764 wrote to memory of 60	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	11
PID 764 wrote to memory of 60	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	11
PID 764 wrote to memory of 60	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	11
PID 764 wrote to memory of 60	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	11
PID 764 wrote to memory of 444	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	76
PID 764 wrote to memory of 444	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	76
PID 764 wrote to memory of 444	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	76
PID 764 wrote to memory of 444	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	76
PID 764 wrote to memory of 444	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	76
PID 764 wrote to memory of 444	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	76
PID 764 wrote to memory of 664	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	12
PID 764 wrote to memory of 664	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	12
PID 764 wrote to memory of 664	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	12
PID 764 wrote to memory of 664	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	12
PID 764 wrote to memory of 664	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	12
PID 764 wrote to memory of 664	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	12
PID 764 wrote to memory of 876	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	75
PID 764 wrote to memory of 876	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	75
PID 764 wrote to memory of 876	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	75
PID 764 wrote to memory of 876	764	60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe	75

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:804
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3464
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3400
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3548
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4584
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:776
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4800
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2816
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3780
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1160
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3092

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe
  "C:\Users\Admin\AppData\Local\Temp\60bd98a5d1c5e77401b5992791e523daa25c9e936ec0bfd8edc52fda95e27ae3.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2668

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2368

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2120

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-132-0x0000000001000000-0x000000000109A000-memory.dmp

Filesize
616KB

Download
memory/764-133-0x0000000001000000-0x000000000109A000-memory.dmp

Filesize
616KB

Download
memory/764-134-0x0000000001000000-0x000000000109A000-memory.dmp

Filesize
616KB

Download