05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a

Analysis

max time kernel
128s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
Size

162KB
MD5

001b96f69d46cd622a3c47f8525be970
SHA1

e94d9388caf6a31427fada8244d5ab6bef6434d3
SHA256

05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a
SHA512

9b3ae33573fd476cdeddcacde2b0c5892e2ac327c51803b96edc04e582f5313a6dfcf9044bac3f02cd82e9f20d549157bef4cf7fdba1adeb58e32b14e9c65c9d
SSDEEP

3072:J4d5Eow66zVJaolwYG0/UQZJAf9DoRBbUyI3Ue8hasCXypNj:+dv6zKYs9URxBI3fsEipN

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe:*:enabled:@shell32.dll,-1"	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe

Suspicious use of SetWindowsHookAW 1 IoCs

pid	Process
536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 596	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	76
PID 536 wrote to memory of 596	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	76
PID 536 wrote to memory of 596	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	76
PID 536 wrote to memory of 596	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	76
PID 536 wrote to memory of 596	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	76
PID 536 wrote to memory of 596	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	76
PID 536 wrote to memory of 648	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	3
PID 536 wrote to memory of 648	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	3
PID 536 wrote to memory of 648	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	3
PID 536 wrote to memory of 648	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	3
PID 536 wrote to memory of 648	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	3
PID 536 wrote to memory of 648	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	3
PID 536 wrote to memory of 756	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	75
PID 536 wrote to memory of 756	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	75
PID 536 wrote to memory of 756	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	75
PID 536 wrote to memory of 756	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	75
PID 536 wrote to memory of 756	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	75
PID 536 wrote to memory of 756	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	75
PID 536 wrote to memory of 764	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	74
PID 536 wrote to memory of 764	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	74
PID 536 wrote to memory of 764	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	74
PID 536 wrote to memory of 764	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	74
PID 536 wrote to memory of 764	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	74
PID 536 wrote to memory of 764	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	74
PID 536 wrote to memory of 772	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	73
PID 536 wrote to memory of 772	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	73
PID 536 wrote to memory of 772	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	73
PID 536 wrote to memory of 772	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	73
PID 536 wrote to memory of 772	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	73
PID 536 wrote to memory of 772	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	73
PID 536 wrote to memory of 880	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	72
PID 536 wrote to memory of 880	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	72
PID 536 wrote to memory of 880	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	72
PID 536 wrote to memory of 880	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	72
PID 536 wrote to memory of 880	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	72
PID 536 wrote to memory of 880	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	72
PID 536 wrote to memory of 932	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	71
PID 536 wrote to memory of 932	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	71
PID 536 wrote to memory of 932	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	71
PID 536 wrote to memory of 932	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	71
PID 536 wrote to memory of 932	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	71
PID 536 wrote to memory of 932	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	71
PID 536 wrote to memory of 1000	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	5
PID 536 wrote to memory of 1000	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	5
PID 536 wrote to memory of 1000	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	5
PID 536 wrote to memory of 1000	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	5
PID 536 wrote to memory of 1000	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	5
PID 536 wrote to memory of 1000	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	5
PID 536 wrote to memory of 424	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	70
PID 536 wrote to memory of 424	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	70
PID 536 wrote to memory of 424	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	70
PID 536 wrote to memory of 424	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	70
PID 536 wrote to memory of 424	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	70
PID 536 wrote to memory of 424	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	70
PID 536 wrote to memory of 604	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	69
PID 536 wrote to memory of 604	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	69
PID 536 wrote to memory of 604	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	69
PID 536 wrote to memory of 604	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	69
PID 536 wrote to memory of 604	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	69
PID 536 wrote to memory of 604	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	69
PID 536 wrote to memory of 844	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	6
PID 536 wrote to memory of 844	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	6
PID 536 wrote to memory of 844	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	6
PID 536 wrote to memory of 844	536	05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe	6

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:648

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1164

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3484

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4952

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4228

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4444

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3516

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3364

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2780

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2484
- C:\Users\Admin\AppData\Local\Temp\05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe
  "C:\Users\Admin\AppData\Local\Temp\05e96f7861bd3bfb427d2a4f0d79c36878432f0c8692216993d92f25e185be3a.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookAW
  - Suspicious use of WriteProcessMemory
  PID:536

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2616

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2456

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4232

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:764

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:756

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-132-0x0000000001000000-0x000000000102D000-memory.dmp

Filesize
180KB

Download
memory/536-133-0x0000000001000000-0x000000000102D000-memory.dmp

Filesize
180KB

Download