fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
Size

689KB
MD5

0df3b2e3719c7bf4f0b50c307c3b8d60
SHA1

e802dca8c258f5c5380130884a2c62338ae251d3
SHA256

fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9
SHA512

071bc691c530e7cb9afe464ee044729c17ee6895ce2dbaa901201d59f448bdf282f9d5911faf064bb1701d2b49a891d19342f68e8dcf6f0aa36d1e9d15dc0477
SSDEEP

12288:Tqn6Y77YnP0mxH56v3P/73fN3UQ9QUfIS4eb:T+6YP4P0mmvr1EQ91o

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe:*:enabled:@shell32.dll,-1"	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 608	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	6
PID 3228 wrote to memory of 608	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	6
PID 3228 wrote to memory of 608	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	6
PID 3228 wrote to memory of 608	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	6
PID 3228 wrote to memory of 608	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	6
PID 3228 wrote to memory of 608	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	6
PID 3228 wrote to memory of 660	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	4
PID 3228 wrote to memory of 660	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	4
PID 3228 wrote to memory of 660	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	4
PID 3228 wrote to memory of 660	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	4
PID 3228 wrote to memory of 660	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	4
PID 3228 wrote to memory of 660	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	4
PID 3228 wrote to memory of 752	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	8
PID 3228 wrote to memory of 752	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	8
PID 3228 wrote to memory of 752	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	8
PID 3228 wrote to memory of 752	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	8
PID 3228 wrote to memory of 752	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	8
PID 3228 wrote to memory of 752	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	8
PID 3228 wrote to memory of 760	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	9
PID 3228 wrote to memory of 760	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	9
PID 3228 wrote to memory of 760	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	9
PID 3228 wrote to memory of 760	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	9
PID 3228 wrote to memory of 760	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	9
PID 3228 wrote to memory of 760	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	9
PID 3228 wrote to memory of 780	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	10
PID 3228 wrote to memory of 780	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	10
PID 3228 wrote to memory of 780	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	10
PID 3228 wrote to memory of 780	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	10
PID 3228 wrote to memory of 780	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	10
PID 3228 wrote to memory of 780	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	10
PID 3228 wrote to memory of 884	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	11
PID 3228 wrote to memory of 884	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	11
PID 3228 wrote to memory of 884	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	11
PID 3228 wrote to memory of 884	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	11
PID 3228 wrote to memory of 884	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	11
PID 3228 wrote to memory of 884	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	11
PID 3228 wrote to memory of 936	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	12
PID 3228 wrote to memory of 936	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	12
PID 3228 wrote to memory of 936	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	12
PID 3228 wrote to memory of 936	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	12
PID 3228 wrote to memory of 936	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	12
PID 3228 wrote to memory of 936	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	12
PID 3228 wrote to memory of 1016	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	13
PID 3228 wrote to memory of 1016	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	13
PID 3228 wrote to memory of 1016	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	13
PID 3228 wrote to memory of 1016	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	13
PID 3228 wrote to memory of 1016	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	13
PID 3228 wrote to memory of 1016	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	13
PID 3228 wrote to memory of 432	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	14
PID 3228 wrote to memory of 432	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	14
PID 3228 wrote to memory of 432	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	14
PID 3228 wrote to memory of 432	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	14
PID 3228 wrote to memory of 432	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	14
PID 3228 wrote to memory of 432	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	14
PID 3228 wrote to memory of 400	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	15
PID 3228 wrote to memory of 400	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	15
PID 3228 wrote to memory of 400	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	15
PID 3228 wrote to memory of 400	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	15
PID 3228 wrote to memory of 400	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	15
PID 3228 wrote to memory of 400	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	15
PID 3228 wrote to memory of 848	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	77
PID 3228 wrote to memory of 848	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	77
PID 3228 wrote to memory of 848	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	77
PID 3228 wrote to memory of 848	3228	fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe	77

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:752
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3420
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2416
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1116
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4608
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4480
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3704
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3504
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3344
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1392

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2648

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2740
- C:\Users\Admin\AppData\Local\Temp\fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe
  "C:\Users\Admin\AppData\Local\Temp\fb2d2889a22c187ee552cae4311588f52adda25789b053165964961022da0cb9.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2612

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2564

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2432

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3228-132-0x0000000001000000-0x00000000010B1000-memory.dmp

Filesize
708KB

Download
memory/3228-133-0x0000000001000000-0x00000000010B1000-memory.dmp

Filesize
708KB

Download