304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
Size

144KB
MD5

90142e2ea04757a218adfe6153ecbaa0
SHA1

4e382e3c9ec68954e8ff6acbd2fe5e34c9603829
SHA256

304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a
SHA512

9a066f28eea058ad9480c5de2ca58245286fc07fcb0684274ad1749335358276b4c53f9cd315bcae1b59bcb063d05519b8dd70b3ecc4984432ea05be3de1aac6
SSDEEP

3072:hbARxFAEM82n7GC2jctoKpsusT2rEFpeoIUpZl1I7j:JNX8I0jct5rEJdpPO

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe:*:enabled:@shell32.dll,-1"	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1296	3464	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 604	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	77
PID 3464 wrote to memory of 604	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	77
PID 3464 wrote to memory of 604	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	77
PID 3464 wrote to memory of 604	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	77
PID 3464 wrote to memory of 604	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	77
PID 3464 wrote to memory of 604	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	77
PID 3464 wrote to memory of 660	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	2
PID 3464 wrote to memory of 660	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	2
PID 3464 wrote to memory of 660	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	2
PID 3464 wrote to memory of 660	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	2
PID 3464 wrote to memory of 660	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	2
PID 3464 wrote to memory of 660	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	2
PID 3464 wrote to memory of 772	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	3
PID 3464 wrote to memory of 772	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	3
PID 3464 wrote to memory of 772	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	3
PID 3464 wrote to memory of 772	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	3
PID 3464 wrote to memory of 772	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	3
PID 3464 wrote to memory of 772	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	3
PID 3464 wrote to memory of 780	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	75
PID 3464 wrote to memory of 780	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	75
PID 3464 wrote to memory of 780	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	75
PID 3464 wrote to memory of 780	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	75
PID 3464 wrote to memory of 780	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	75
PID 3464 wrote to memory of 780	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	75
PID 3464 wrote to memory of 784	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	74
PID 3464 wrote to memory of 784	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	74
PID 3464 wrote to memory of 784	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	74
PID 3464 wrote to memory of 784	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	74
PID 3464 wrote to memory of 784	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	74
PID 3464 wrote to memory of 784	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	74
PID 3464 wrote to memory of 884	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	73
PID 3464 wrote to memory of 884	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	73
PID 3464 wrote to memory of 884	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	73
PID 3464 wrote to memory of 884	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	73
PID 3464 wrote to memory of 884	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	73
PID 3464 wrote to memory of 884	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	73
PID 3464 wrote to memory of 940	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	72
PID 3464 wrote to memory of 940	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	72
PID 3464 wrote to memory of 940	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	72
PID 3464 wrote to memory of 940	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	72
PID 3464 wrote to memory of 940	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	72
PID 3464 wrote to memory of 940	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	72
PID 3464 wrote to memory of 1016	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	4
PID 3464 wrote to memory of 1016	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	4
PID 3464 wrote to memory of 1016	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	4
PID 3464 wrote to memory of 1016	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	4
PID 3464 wrote to memory of 1016	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	4
PID 3464 wrote to memory of 1016	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	4
PID 3464 wrote to memory of 428	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	71
PID 3464 wrote to memory of 428	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	71
PID 3464 wrote to memory of 428	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	71
PID 3464 wrote to memory of 428	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	71
PID 3464 wrote to memory of 428	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	71
PID 3464 wrote to memory of 428	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	71
PID 3464 wrote to memory of 680	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	70
PID 3464 wrote to memory of 680	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	70
PID 3464 wrote to memory of 680	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	70
PID 3464 wrote to memory of 680	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	70
PID 3464 wrote to memory of 680	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	70
PID 3464 wrote to memory of 680	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	70
PID 3464 wrote to memory of 612	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	5
PID 3464 wrote to memory of 612	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	5
PID 3464 wrote to memory of 612	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	5
PID 3464 wrote to memory of 612	3464	304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe	5

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3424
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4644
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1932
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1740
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4760
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4464
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3808
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3516
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3356
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3268
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4932

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1228

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:332

C:\Users\Admin\AppData\Local\Temp\304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe
"C:\Users\Admin\AppData\Local\Temp\304133ec21c667680aab416e5146f36aa9bf01e758b157618c24a94f9b83c72a.exe"
1⤵
- Modifies firewall policy service
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 900
  2⤵
  - Program crash
  PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1996

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2736

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2524

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1700

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3464 -ip 3464
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3464-132-0x0000000001000000-0x0000000001029000-memory.dmp

Filesize
164KB

Download
memory/3464-133-0x0000000001000000-0x0000000001029000-memory.dmp

Filesize
164KB

Download