66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Size

71KB
MD5

0cc039486bd90e3f703cb34002b40f50
SHA1

6d7c268314edd111e165bee4a1f1d89b260c9013
SHA256

66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd
SHA512

2f5430c2d5a828a92faef258313d88cf66115d0cf4dc7f56ec7ae16e3442d19f1e03b2732aa216c0c2b6a08bdefb8d50a686efd856c89f077ee378fd786e981b
SSDEEP

1536:Huv9rWZXUCj3m8BTwQhSHNtsC/6PRyyzpU3V9C:HugX9PwQhSHv//Iy79

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe:*:enabled:@shell32.dll,-1"	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeBackupPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
Token: SeSecurityPrivilege	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 604	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	3
PID 2752 wrote to memory of 604	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	3
PID 2752 wrote to memory of 604	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	3
PID 2752 wrote to memory of 604	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	3
PID 2752 wrote to memory of 604	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	3
PID 2752 wrote to memory of 604	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	3
PID 2752 wrote to memory of 664	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	1
PID 2752 wrote to memory of 664	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	1
PID 2752 wrote to memory of 664	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	1
PID 2752 wrote to memory of 664	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	1
PID 2752 wrote to memory of 664	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	1
PID 2752 wrote to memory of 664	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	1
PID 2752 wrote to memory of 776	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	33
PID 2752 wrote to memory of 776	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	33
PID 2752 wrote to memory of 776	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	33
PID 2752 wrote to memory of 776	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	33
PID 2752 wrote to memory of 776	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	33
PID 2752 wrote to memory of 776	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	33
PID 2752 wrote to memory of 792	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	8
PID 2752 wrote to memory of 792	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	8
PID 2752 wrote to memory of 792	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	8
PID 2752 wrote to memory of 792	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	8
PID 2752 wrote to memory of 792	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	8
PID 2752 wrote to memory of 792	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	8
PID 2752 wrote to memory of 800	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	15
PID 2752 wrote to memory of 800	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	15
PID 2752 wrote to memory of 800	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	15
PID 2752 wrote to memory of 800	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	15
PID 2752 wrote to memory of 800	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	15
PID 2752 wrote to memory of 800	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	15
PID 2752 wrote to memory of 896	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	9
PID 2752 wrote to memory of 896	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	9
PID 2752 wrote to memory of 896	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	9
PID 2752 wrote to memory of 896	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	9
PID 2752 wrote to memory of 896	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	9
PID 2752 wrote to memory of 896	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	9
PID 2752 wrote to memory of 948	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	10
PID 2752 wrote to memory of 948	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	10
PID 2752 wrote to memory of 948	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	10
PID 2752 wrote to memory of 948	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	10
PID 2752 wrote to memory of 948	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	10
PID 2752 wrote to memory of 948	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	10
PID 2752 wrote to memory of 312	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	11
PID 2752 wrote to memory of 312	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	11
PID 2752 wrote to memory of 312	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	11
PID 2752 wrote to memory of 312	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	11
PID 2752 wrote to memory of 312	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	11
PID 2752 wrote to memory of 312	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	11
PID 2752 wrote to memory of 532	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	14
PID 2752 wrote to memory of 532	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	14
PID 2752 wrote to memory of 532	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	14
PID 2752 wrote to memory of 532	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	14
PID 2752 wrote to memory of 532	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	14
PID 2752 wrote to memory of 532	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	14
PID 2752 wrote to memory of 676	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	12
PID 2752 wrote to memory of 676	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	12
PID 2752 wrote to memory of 676	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	12
PID 2752 wrote to memory of 676	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	12
PID 2752 wrote to memory of 676	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	12
PID 2752 wrote to memory of 676	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	12
PID 2752 wrote to memory of 944	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	13
PID 2752 wrote to memory of 944	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	13
PID 2752 wrote to memory of 944	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	13
PID 2752 wrote to memory of 944	2752	66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe	13

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:792
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:532

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1044
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1300
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:776
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3876
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4800
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:2332
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4560
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4396
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3700
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3560
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3468
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3400
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1356

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2576
- C:\Users\Admin\AppData\Local\Temp\66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe
  "C:\Users\Admin\AppData\Local\Temp\66c7c9ebe1f3d96eca1d75bec8141a0210b4757f2e24d60f51caa051b2d617bd.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2592

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-132-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download
memory/2752-133-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download