1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6

Analysis

max time kernel
54s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
Size

752KB
MD5

a30afa92643da0ff80f2afe289d1c37d
SHA1

9575258e6b5f3b92cdecbf17fee0a9114f9ff433
SHA256

1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6
SHA512

29698b04692cbac6c993fbf86924a54e026070b66b133cec99f15b74fb0bcb501a6341c8467cb03027d7c223b920abe7f316ce93a5474e48f8166075dd3c1c07
SSDEEP

12288:d6QXqw9MgKnxYaGu5jji2YQ6MpzUK1bOnnCOazb4gR8wmq3/PFdTyVDHG:5DKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVr

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe:*:enabled:@shell32.dll,-1"	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1664	2908	WerFault.exe	81
3540	2908	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 604	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	3
PID 2908 wrote to memory of 604	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	3
PID 2908 wrote to memory of 604	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	3
PID 2908 wrote to memory of 604	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	3
PID 2908 wrote to memory of 604	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	3
PID 2908 wrote to memory of 604	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	3
PID 2908 wrote to memory of 664	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	1
PID 2908 wrote to memory of 664	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	1
PID 2908 wrote to memory of 664	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	1
PID 2908 wrote to memory of 664	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	1
PID 2908 wrote to memory of 664	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	1
PID 2908 wrote to memory of 664	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	1
PID 2908 wrote to memory of 772	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	9
PID 2908 wrote to memory of 772	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	9
PID 2908 wrote to memory of 772	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	9
PID 2908 wrote to memory of 772	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	9
PID 2908 wrote to memory of 772	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	9
PID 2908 wrote to memory of 772	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	9
PID 2908 wrote to memory of 780	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	8
PID 2908 wrote to memory of 780	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	8
PID 2908 wrote to memory of 780	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	8
PID 2908 wrote to memory of 780	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	8
PID 2908 wrote to memory of 780	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	8
PID 2908 wrote to memory of 780	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	8
PID 2908 wrote to memory of 788	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	80
PID 2908 wrote to memory of 788	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	80
PID 2908 wrote to memory of 788	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	80
PID 2908 wrote to memory of 788	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	80
PID 2908 wrote to memory of 788	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	80
PID 2908 wrote to memory of 788	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	80
PID 2908 wrote to memory of 900	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	79
PID 2908 wrote to memory of 900	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	79
PID 2908 wrote to memory of 900	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	79
PID 2908 wrote to memory of 900	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	79
PID 2908 wrote to memory of 900	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	79
PID 2908 wrote to memory of 900	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	79
PID 2908 wrote to memory of 948	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	11
PID 2908 wrote to memory of 948	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	11
PID 2908 wrote to memory of 948	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	11
PID 2908 wrote to memory of 948	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	11
PID 2908 wrote to memory of 948	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	11
PID 2908 wrote to memory of 948	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	11
PID 2908 wrote to memory of 332	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	10
PID 2908 wrote to memory of 332	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	10
PID 2908 wrote to memory of 332	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	10
PID 2908 wrote to memory of 332	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	10
PID 2908 wrote to memory of 332	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	10
PID 2908 wrote to memory of 332	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	10
PID 2908 wrote to memory of 508	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	78
PID 2908 wrote to memory of 508	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	78
PID 2908 wrote to memory of 508	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	78
PID 2908 wrote to memory of 508	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	78
PID 2908 wrote to memory of 508	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	78
PID 2908 wrote to memory of 508	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	78
PID 2908 wrote to memory of 680	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	22
PID 2908 wrote to memory of 680	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	22
PID 2908 wrote to memory of 680	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	22
PID 2908 wrote to memory of 680	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	22
PID 2908 wrote to memory of 680	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	22
PID 2908 wrote to memory of 680	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	22
PID 2908 wrote to memory of 992	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	21
PID 2908 wrote to memory of 992	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	21
PID 2908 wrote to memory of 992	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	21
PID 2908 wrote to memory of 992	2908	1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe	21

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3456
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3512
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3404
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3824
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3620
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3308
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2260
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1528
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4344
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4544
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1112
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1340
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3108

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2228
- C:\Users\Admin\AppData\Local\Temp\1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe
  "C:\Users\Admin\AppData\Local\Temp\1fc65f0988107bd63d2e963762b7631007840b4ae699bc903321a16fc49600c6.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 628
    3⤵
    - Program crash
    PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 636
    3⤵
    - Program crash
    PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2748

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2140

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2908 -ip 2908
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2908 -ip 2908
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-132-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2908-133-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download