350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
Size

322KB
MD5

0ad7883c574699de62258befc4a03070
SHA1

794ba22b81a1c54904e006b9d81ef2647eb529e5
SHA256

350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70
SHA512

3153e6366c5620695bab11e529e4186760d661cd5eb2e4e09e52d04ac696e56f87ffe3043ccfb009134329697963c02dada213282bc60507f0abab2530d904e9
SSDEEP

3072:w/Fkbf8/FoeMrx9O1vfjQdLCQMcP7FRCMk8jyGez1c9zeu09UG8:w9kbwoLtM1nM9xf/CMk8mt+wu0iG8

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe:*:enabled:@shell32.dll,-1"	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 596	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	3
PID 4256 wrote to memory of 596	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	3
PID 4256 wrote to memory of 596	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	3
PID 4256 wrote to memory of 596	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	3
PID 4256 wrote to memory of 596	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	3
PID 4256 wrote to memory of 596	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	3
PID 4256 wrote to memory of 680	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	4
PID 4256 wrote to memory of 680	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	4
PID 4256 wrote to memory of 680	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	4
PID 4256 wrote to memory of 680	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	4
PID 4256 wrote to memory of 680	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	4
PID 4256 wrote to memory of 680	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	4
PID 4256 wrote to memory of 788	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	5
PID 4256 wrote to memory of 788	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	5
PID 4256 wrote to memory of 788	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	5
PID 4256 wrote to memory of 788	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	5
PID 4256 wrote to memory of 788	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	5
PID 4256 wrote to memory of 788	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	5
PID 4256 wrote to memory of 792	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	78
PID 4256 wrote to memory of 792	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	78
PID 4256 wrote to memory of 792	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	78
PID 4256 wrote to memory of 792	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	78
PID 4256 wrote to memory of 792	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	78
PID 4256 wrote to memory of 792	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	78
PID 4256 wrote to memory of 804	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	77
PID 4256 wrote to memory of 804	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	77
PID 4256 wrote to memory of 804	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	77
PID 4256 wrote to memory of 804	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	77
PID 4256 wrote to memory of 804	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	77
PID 4256 wrote to memory of 804	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	77
PID 4256 wrote to memory of 916	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	76
PID 4256 wrote to memory of 916	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	76
PID 4256 wrote to memory of 916	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	76
PID 4256 wrote to memory of 916	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	76
PID 4256 wrote to memory of 916	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	76
PID 4256 wrote to memory of 916	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	76
PID 4256 wrote to memory of 964	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	75
PID 4256 wrote to memory of 964	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	75
PID 4256 wrote to memory of 964	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	75
PID 4256 wrote to memory of 964	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	75
PID 4256 wrote to memory of 964	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	75
PID 4256 wrote to memory of 964	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	75
PID 4256 wrote to memory of 372	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	6
PID 4256 wrote to memory of 372	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	6
PID 4256 wrote to memory of 372	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	6
PID 4256 wrote to memory of 372	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	6
PID 4256 wrote to memory of 372	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	6
PID 4256 wrote to memory of 372	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	6
PID 4256 wrote to memory of 524	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	74
PID 4256 wrote to memory of 524	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	74
PID 4256 wrote to memory of 524	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	74
PID 4256 wrote to memory of 524	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	74
PID 4256 wrote to memory of 524	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	74
PID 4256 wrote to memory of 524	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	74
PID 4256 wrote to memory of 728	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	73
PID 4256 wrote to memory of 728	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	73
PID 4256 wrote to memory of 728	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	73
PID 4256 wrote to memory of 728	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	73
PID 4256 wrote to memory of 728	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	73
PID 4256 wrote to memory of 728	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	73
PID 4256 wrote to memory of 932	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	72
PID 4256 wrote to memory of 932	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	72
PID 4256 wrote to memory of 932	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	72
PID 4256 wrote to memory of 932	4256	350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe	72

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:596
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:372

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2168

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3536

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4088

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3936

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:3796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1436

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4948

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4548

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4428

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3828

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3624

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3472

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3196

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3080
- C:\Users\Admin\AppData\Local\Temp\350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe
  "C:\Users\Admin\AppData\Local\Temp\350c5e87fffc1d197db8f71d10d5687b1218c536c369bec6401fd3df1dfdaf70.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2740

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2484

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2112

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4256-132-0x000000004AD00000-0x000000004AD54000-memory.dmp

Filesize
336KB

Download
memory/4256-133-0x000000004AD00000-0x000000004AD54000-memory.dmp

Filesize
336KB

Download