1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
Size

79KB
MD5

07dff2a311db8bc203af6249d8b90c00
SHA1

cd71d2be491772794ad97587a125d40251cf427f
SHA256

1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21
SHA512

e2269dbe0a938d5a6ec68529a38b3cdffc854cb571cae6d488bc75a5f6eadf54d20e34b0a3e91ae20cec754e1f372dc2d7a520d573ce41bf192bb4e6c0a35cb8
SSDEEP

1536:IvFxxXsCQoFaGixdBjpEV4y8i21rvdv/vnkOl+NLu:IvrcGijBeKy8icC++N

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe:*:enabled:@shell32.dll,-1"	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 592	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	5
PID 540 wrote to memory of 592	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	5
PID 540 wrote to memory of 592	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	5
PID 540 wrote to memory of 592	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	5
PID 540 wrote to memory of 592	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	5
PID 540 wrote to memory of 592	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	5
PID 540 wrote to memory of 660	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	3
PID 540 wrote to memory of 660	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	3
PID 540 wrote to memory of 660	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	3
PID 540 wrote to memory of 660	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	3
PID 540 wrote to memory of 660	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	3
PID 540 wrote to memory of 660	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	3
PID 540 wrote to memory of 772	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	8
PID 540 wrote to memory of 772	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	8
PID 540 wrote to memory of 772	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	8
PID 540 wrote to memory of 772	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	8
PID 540 wrote to memory of 772	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	8
PID 540 wrote to memory of 772	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	8
PID 540 wrote to memory of 784	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	18
PID 540 wrote to memory of 784	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	18
PID 540 wrote to memory of 784	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	18
PID 540 wrote to memory of 784	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	18
PID 540 wrote to memory of 784	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	18
PID 540 wrote to memory of 784	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	18
PID 540 wrote to memory of 792	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	17
PID 540 wrote to memory of 792	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	17
PID 540 wrote to memory of 792	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	17
PID 540 wrote to memory of 792	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	17
PID 540 wrote to memory of 792	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	17
PID 540 wrote to memory of 792	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	17
PID 540 wrote to memory of 896	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	16
PID 540 wrote to memory of 896	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	16
PID 540 wrote to memory of 896	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	16
PID 540 wrote to memory of 896	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	16
PID 540 wrote to memory of 896	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	16
PID 540 wrote to memory of 896	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	16
PID 540 wrote to memory of 944	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	9
PID 540 wrote to memory of 944	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	9
PID 540 wrote to memory of 944	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	9
PID 540 wrote to memory of 944	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	9
PID 540 wrote to memory of 944	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	9
PID 540 wrote to memory of 944	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	9
PID 540 wrote to memory of 312	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	12
PID 540 wrote to memory of 312	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	12
PID 540 wrote to memory of 312	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	12
PID 540 wrote to memory of 312	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	12
PID 540 wrote to memory of 312	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	12
PID 540 wrote to memory of 312	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	12
PID 540 wrote to memory of 524	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	11
PID 540 wrote to memory of 524	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	11
PID 540 wrote to memory of 524	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	11
PID 540 wrote to memory of 524	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	11
PID 540 wrote to memory of 524	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	11
PID 540 wrote to memory of 524	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	11
PID 540 wrote to memory of 680	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	10
PID 540 wrote to memory of 680	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	10
PID 540 wrote to memory of 680	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	10
PID 540 wrote to memory of 680	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	10
PID 540 wrote to memory of 680	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	10
PID 540 wrote to memory of 680	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	10
PID 540 wrote to memory of 808	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	13
PID 540 wrote to memory of 808	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	13
PID 540 wrote to memory of 808	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	13
PID 540 wrote to memory of 808	540	1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe	13

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:592
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3384
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3460
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4404
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3724
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3556
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3300
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:3448
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4420
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1852

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1396
- C:\Users\Admin\AppData\Local\Temp\1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe
  "C:\Users\Admin\AppData\Local\Temp\1ae3577c04b18086770a8a3c857f9e4e0a08d241b8df595d52e3947760cabf21.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2724

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2580

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2572

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-132-0x0000000001000000-0x0000000001019000-memory.dmp

Filesize
100KB

Download