93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85

Analysis

max time kernel
61s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
Size

40KB
MD5

043c8aca83ec4f06c240c9e62af6e2e0
SHA1

03659d46df94706cc019bfdbc67bc5211f507a00
SHA256

93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85
SHA512

69e5724d40cc1852600d065f594adcee552532b7fb6fee6e39ddd40c2eaf72f01db46ffd5dc456560eacedd7613b15b5dedfdd5f42595a50c46d25b0b334e387
SSDEEP

768:ns201O+jN/OLtQBySYWqfBHS7/7L2P44G/A82F1AuTAhhNCpIrYVN4TgWbHmEjYV:ns201O+jdeSYWqATl4GYhy8IrCSPzmm

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe:*:enabled:@shell32.dll,-1"	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 604	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	3
PID 3032 wrote to memory of 604	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	3
PID 3032 wrote to memory of 604	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	3
PID 3032 wrote to memory of 604	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	3
PID 3032 wrote to memory of 604	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	3
PID 3032 wrote to memory of 604	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	3
PID 3032 wrote to memory of 688	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	1
PID 3032 wrote to memory of 688	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	1
PID 3032 wrote to memory of 688	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	1
PID 3032 wrote to memory of 688	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	1
PID 3032 wrote to memory of 688	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	1
PID 3032 wrote to memory of 688	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	1
PID 3032 wrote to memory of 776	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	5
PID 3032 wrote to memory of 776	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	5
PID 3032 wrote to memory of 776	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	5
PID 3032 wrote to memory of 776	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	5
PID 3032 wrote to memory of 776	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	5
PID 3032 wrote to memory of 776	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	5
PID 3032 wrote to memory of 784	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	78
PID 3032 wrote to memory of 784	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	78
PID 3032 wrote to memory of 784	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	78
PID 3032 wrote to memory of 784	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	78
PID 3032 wrote to memory of 784	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	78
PID 3032 wrote to memory of 784	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	78
PID 3032 wrote to memory of 808	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	6
PID 3032 wrote to memory of 808	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	6
PID 3032 wrote to memory of 808	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	6
PID 3032 wrote to memory of 808	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	6
PID 3032 wrote to memory of 808	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	6
PID 3032 wrote to memory of 808	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	6
PID 3032 wrote to memory of 908	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	77
PID 3032 wrote to memory of 908	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	77
PID 3032 wrote to memory of 908	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	77
PID 3032 wrote to memory of 908	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	77
PID 3032 wrote to memory of 908	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	77
PID 3032 wrote to memory of 908	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	77
PID 3032 wrote to memory of 968	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	7
PID 3032 wrote to memory of 968	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	7
PID 3032 wrote to memory of 968	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	7
PID 3032 wrote to memory of 968	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	7
PID 3032 wrote to memory of 968	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	7
PID 3032 wrote to memory of 968	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	7
PID 3032 wrote to memory of 412	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	76
PID 3032 wrote to memory of 412	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	76
PID 3032 wrote to memory of 412	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	76
PID 3032 wrote to memory of 412	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	76
PID 3032 wrote to memory of 412	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	76
PID 3032 wrote to memory of 412	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	76
PID 3032 wrote to memory of 492	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	75
PID 3032 wrote to memory of 492	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	75
PID 3032 wrote to memory of 492	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	75
PID 3032 wrote to memory of 492	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	75
PID 3032 wrote to memory of 492	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	75
PID 3032 wrote to memory of 492	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	75
PID 3032 wrote to memory of 732	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	74
PID 3032 wrote to memory of 732	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	74
PID 3032 wrote to memory of 732	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	74
PID 3032 wrote to memory of 732	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	74
PID 3032 wrote to memory of 732	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	74
PID 3032 wrote to memory of 732	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	74
PID 3032 wrote to memory of 668	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	8
PID 3032 wrote to memory of 668	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	8
PID 3032 wrote to memory of 668	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	8
PID 3032 wrote to memory of 668	3032	93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe	8

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:808
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3456
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:2332
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:5100
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:5076
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4820
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3764
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3580
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3352
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3344
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3244
- C:\Windows\System32\wuapihost.exe
  C:\Windows\System32\wuapihost.exe -Embedding
  2⤵
  PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1364

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2768

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3068
- C:\Users\Admin\AppData\Local\Temp\93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe
  "C:\Users\Admin\AppData\Local\Temp\93110711068775392d4729e7cb1e41aca70675de646349871811268831f17a85.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2556

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2536

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2116

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-132-0x0000000001000000-0x000000000100D000-memory.dmp

Filesize
52KB

Download