96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039

Analysis

max time kernel
124s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
Size

162KB
MD5

00651825598e33d70255d106aa8f8f30
SHA1

a50e1fe054d4882c566a91e6e07c9ecc11f690e7
SHA256

96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039
SHA512

067bc11f1b43232e9ef507dd4f833999ccfde04623e982ed06e2f3808cec218cf71ea121747aea9232f16e85063d04e1db47301966bab040e6a9b0179a31e5bc
SSDEEP

3072:V4d5Eow66zVJaolwYG0/xZJAV9DoRBbGyI3R4OXUsm:6dv6zKYO9URxjI3ws

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe:*:enabled:@shell32.dll,-1"	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe

Suspicious use of SetWindowsHookAW 1 IoCs

pid	Process
1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 624	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	3
PID 1928 wrote to memory of 624	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	3
PID 1928 wrote to memory of 624	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	3
PID 1928 wrote to memory of 624	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	3
PID 1928 wrote to memory of 624	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	3
PID 1928 wrote to memory of 624	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	3
PID 1928 wrote to memory of 680	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	1
PID 1928 wrote to memory of 680	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	1
PID 1928 wrote to memory of 680	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	1
PID 1928 wrote to memory of 680	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	1
PID 1928 wrote to memory of 680	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	1
PID 1928 wrote to memory of 680	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	1
PID 1928 wrote to memory of 788	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	76
PID 1928 wrote to memory of 788	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	76
PID 1928 wrote to memory of 788	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	76
PID 1928 wrote to memory of 788	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	76
PID 1928 wrote to memory of 788	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	76
PID 1928 wrote to memory of 788	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	76
PID 1928 wrote to memory of 804	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	5
PID 1928 wrote to memory of 804	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	5
PID 1928 wrote to memory of 804	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	5
PID 1928 wrote to memory of 804	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	5
PID 1928 wrote to memory of 804	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	5
PID 1928 wrote to memory of 804	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	5
PID 1928 wrote to memory of 800	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	75
PID 1928 wrote to memory of 800	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	75
PID 1928 wrote to memory of 800	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	75
PID 1928 wrote to memory of 800	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	75
PID 1928 wrote to memory of 800	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	75
PID 1928 wrote to memory of 800	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	75
PID 1928 wrote to memory of 912	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	74
PID 1928 wrote to memory of 912	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	74
PID 1928 wrote to memory of 912	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	74
PID 1928 wrote to memory of 912	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	74
PID 1928 wrote to memory of 912	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	74
PID 1928 wrote to memory of 912	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	74
PID 1928 wrote to memory of 960	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	73
PID 1928 wrote to memory of 960	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	73
PID 1928 wrote to memory of 960	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	73
PID 1928 wrote to memory of 960	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	73
PID 1928 wrote to memory of 960	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	73
PID 1928 wrote to memory of 960	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	73
PID 1928 wrote to memory of 60	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	6
PID 1928 wrote to memory of 60	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	6
PID 1928 wrote to memory of 60	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	6
PID 1928 wrote to memory of 60	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	6
PID 1928 wrote to memory of 60	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	6
PID 1928 wrote to memory of 60	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	6
PID 1928 wrote to memory of 444	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	72
PID 1928 wrote to memory of 444	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	72
PID 1928 wrote to memory of 444	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	72
PID 1928 wrote to memory of 444	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	72
PID 1928 wrote to memory of 444	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	72
PID 1928 wrote to memory of 444	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	72
PID 1928 wrote to memory of 664	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	7
PID 1928 wrote to memory of 664	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	7
PID 1928 wrote to memory of 664	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	7
PID 1928 wrote to memory of 664	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	7
PID 1928 wrote to memory of 664	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	7
PID 1928 wrote to memory of 664	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	7
PID 1928 wrote to memory of 876	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	8
PID 1928 wrote to memory of 876	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	8
PID 1928 wrote to memory of 876	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	8
PID 1928 wrote to memory of 876	1928	96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe	8

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:804
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1160
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2524

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe
  "C:\Users\Admin\AppData\Local\Temp\96ea934550e737a8ed59ca607986e8e4c4476ca746cad47caab6b7d231a10039.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookAW
  - Suspicious use of WriteProcessMemory
  PID:1928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3464

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3400

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3092

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1460

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2196

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:776

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4680

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4800

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2816

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2668

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2368

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2284

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-132-0x0000000001000000-0x000000000102D000-memory.dmp

Filesize
180KB

Download
memory/1928-133-0x0000000001000000-0x000000000102D000-memory.dmp

Filesize
180KB

Download