544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d

Analysis

max time kernel
149s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
Size

42KB
MD5

459130c359032a68e5c0428adce54920
SHA1

d87819573e05ea9f5ef90d487b04b6c54595d012
SHA256

544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d
SHA512

64e1ce8b950eebad52180e091b9a85f4228ac37507a810bea02bff6041cb8adeb6ece0c52743bba489c02c63ad6bf3bd4e54b8bbc9e393150402b3c530a26724
SSDEEP

768:mwVIZU6TXolKInHe2Z73g4xz8JyPuAM1l2yLntZoa0gxCeJqB0k:XVIy6TKnHVZ71F8JD0ahCoS0k

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe:*:enabled:@shell32.dll,-1"	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	4924	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 600	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	19
PID 4924 wrote to memory of 600	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	19
PID 4924 wrote to memory of 600	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	19
PID 4924 wrote to memory of 600	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	19
PID 4924 wrote to memory of 600	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	19
PID 4924 wrote to memory of 600	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	19
PID 4924 wrote to memory of 656	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	1
PID 4924 wrote to memory of 656	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	1
PID 4924 wrote to memory of 656	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	1
PID 4924 wrote to memory of 656	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	1
PID 4924 wrote to memory of 656	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	1
PID 4924 wrote to memory of 656	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	1
PID 4924 wrote to memory of 772	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	18
PID 4924 wrote to memory of 772	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	18
PID 4924 wrote to memory of 772	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	18
PID 4924 wrote to memory of 772	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	18
PID 4924 wrote to memory of 772	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	18
PID 4924 wrote to memory of 772	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	18
PID 4924 wrote to memory of 780	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	17
PID 4924 wrote to memory of 780	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	17
PID 4924 wrote to memory of 780	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	17
PID 4924 wrote to memory of 780	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	17
PID 4924 wrote to memory of 780	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	17
PID 4924 wrote to memory of 780	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	17
PID 4924 wrote to memory of 788	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	3
PID 4924 wrote to memory of 788	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	3
PID 4924 wrote to memory of 788	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	3
PID 4924 wrote to memory of 788	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	3
PID 4924 wrote to memory of 788	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	3
PID 4924 wrote to memory of 788	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	3
PID 4924 wrote to memory of 904	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	14
PID 4924 wrote to memory of 904	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	14
PID 4924 wrote to memory of 904	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	14
PID 4924 wrote to memory of 904	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	14
PID 4924 wrote to memory of 904	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	14
PID 4924 wrote to memory of 904	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	14
PID 4924 wrote to memory of 952	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	13
PID 4924 wrote to memory of 952	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	13
PID 4924 wrote to memory of 952	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	13
PID 4924 wrote to memory of 952	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	13
PID 4924 wrote to memory of 952	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	13
PID 4924 wrote to memory of 952	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	13
PID 4924 wrote to memory of 312	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	4
PID 4924 wrote to memory of 312	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	4
PID 4924 wrote to memory of 312	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	4
PID 4924 wrote to memory of 312	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	4
PID 4924 wrote to memory of 312	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	4
PID 4924 wrote to memory of 312	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	4
PID 4924 wrote to memory of 388	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	6
PID 4924 wrote to memory of 388	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	6
PID 4924 wrote to memory of 388	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	6
PID 4924 wrote to memory of 388	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	6
PID 4924 wrote to memory of 388	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	6
PID 4924 wrote to memory of 388	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	6
PID 4924 wrote to memory of 608	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	5
PID 4924 wrote to memory of 608	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	5
PID 4924 wrote to memory of 608	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	5
PID 4924 wrote to memory of 608	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	5
PID 4924 wrote to memory of 608	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	5
PID 4924 wrote to memory of 608	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	5
PID 4924 wrote to memory of 948	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	12
PID 4924 wrote to memory of 948	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	12
PID 4924 wrote to memory of 948	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	12
PID 4924 wrote to memory of 948	4924	544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe	12

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:656

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1112
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1288
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1344

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3360
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3424
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3524
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4968
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4116
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:3508
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1064
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:2280
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4620
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4376
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3640
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3268

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:8

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2640
- C:\Users\Admin\AppData\Local\Temp\544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe
  "C:\Users\Admin\AppData\Local\Temp\544246a35b664afa3bca0fdde2fc51c08ee937d5125dfd605769c5a755c3190d.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 504
    3⤵
    - Program crash
    PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2592

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2064

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4924 -ip 4924
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4924-132-0x0000000001000000-0x000000000100E000-memory.dmp

Filesize
56KB

Download