dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
Size

104KB
MD5

0e57bb0aa70aac38890da23eb324c890
SHA1

fda9b1e55edafd84c6b8a35f36401b98c7f52998
SHA256

dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68
SHA512

3c5846b1d2208b2400d88f603eefc77ffde13f9325feb68b142442a1139a27017d207fb9dcf4d31256bd0ca88e17260787ac6902e438136c715904083c5e6e99
SSDEEP

3072:BTe4LbdbC+2kYtEFCAipOLq7y7e6rtrCDglXwrXe:5dbC+2kY+FP7e6rtGglgLe

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe:*:enabled:@shell32.dll,-1"	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 608	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	6
PID 4888 wrote to memory of 608	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	6
PID 4888 wrote to memory of 608	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	6
PID 4888 wrote to memory of 608	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	6
PID 4888 wrote to memory of 608	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	6
PID 4888 wrote to memory of 608	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	6
PID 4888 wrote to memory of 660	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	4
PID 4888 wrote to memory of 660	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	4
PID 4888 wrote to memory of 660	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	4
PID 4888 wrote to memory of 660	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	4
PID 4888 wrote to memory of 660	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	4
PID 4888 wrote to memory of 660	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	4
PID 4888 wrote to memory of 772	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	8
PID 4888 wrote to memory of 772	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	8
PID 4888 wrote to memory of 772	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	8
PID 4888 wrote to memory of 772	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	8
PID 4888 wrote to memory of 772	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	8
PID 4888 wrote to memory of 772	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	8
PID 4888 wrote to memory of 780	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	9
PID 4888 wrote to memory of 780	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	9
PID 4888 wrote to memory of 780	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	9
PID 4888 wrote to memory of 780	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	9
PID 4888 wrote to memory of 780	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	9
PID 4888 wrote to memory of 780	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	9
PID 4888 wrote to memory of 792	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	19
PID 4888 wrote to memory of 792	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	19
PID 4888 wrote to memory of 792	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	19
PID 4888 wrote to memory of 792	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	19
PID 4888 wrote to memory of 792	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	19
PID 4888 wrote to memory of 792	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	19
PID 4888 wrote to memory of 892	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	18
PID 4888 wrote to memory of 892	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	18
PID 4888 wrote to memory of 892	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	18
PID 4888 wrote to memory of 892	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	18
PID 4888 wrote to memory of 892	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	18
PID 4888 wrote to memory of 892	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	18
PID 4888 wrote to memory of 940	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	10
PID 4888 wrote to memory of 940	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	10
PID 4888 wrote to memory of 940	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	10
PID 4888 wrote to memory of 940	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	10
PID 4888 wrote to memory of 940	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	10
PID 4888 wrote to memory of 940	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	10
PID 4888 wrote to memory of 312	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	17
PID 4888 wrote to memory of 312	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	17
PID 4888 wrote to memory of 312	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	17
PID 4888 wrote to memory of 312	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	17
PID 4888 wrote to memory of 312	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	17
PID 4888 wrote to memory of 312	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	17
PID 4888 wrote to memory of 432	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	11
PID 4888 wrote to memory of 432	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	11
PID 4888 wrote to memory of 432	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	11
PID 4888 wrote to memory of 432	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	11
PID 4888 wrote to memory of 432	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	11
PID 4888 wrote to memory of 432	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	11
PID 4888 wrote to memory of 712	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	12
PID 4888 wrote to memory of 712	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	12
PID 4888 wrote to memory of 712	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	12
PID 4888 wrote to memory of 712	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	12
PID 4888 wrote to memory of 712	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	12
PID 4888 wrote to memory of 712	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	12
PID 4888 wrote to memory of 988	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	13
PID 4888 wrote to memory of 988	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	13
PID 4888 wrote to memory of 988	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	13
PID 4888 wrote to memory of 988	4888	dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe	13

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3368
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3280
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3436
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:3800
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2024
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4676
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4480
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3732
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1072
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:892

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1280
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1988

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2620

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2636

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2560
- C:\Users\Admin\AppData\Local\Temp\dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe
  "C:\Users\Admin\AppData\Local\Temp\dc737a3b49329ca7480fd9abc8cae37fa24b60beeb291a047950ea3a92062b68.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-132-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download
memory/4888-133-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download