2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
Size

59KB
MD5

0e8c14f99b6e21d1241227773067fc77
SHA1

e296463d825bd8f124bb9a5830bb91a946b8e91f
SHA256

2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c
SHA512

f2c0785115565a4936755a39452d45d28a7786c0c4a26567e99512e7e03066798bba1d820ea285a6faae542b32e5bcf9de497d8944eb01f3e474795a7af49c5f
SSDEEP

768:gmK9BSp2B82r4IabOOeEM8HhaE3107giP23yElhrp5jDuIdGBUgmUz7jjAfyD9Gy:O22B82rnqeET2zWPp03zzAf4Gbv

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe:*:enabled:@shell32.dll,-1"	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\wuaucldt.exe	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3604	4640	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 616	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	5
PID 4640 wrote to memory of 616	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	5
PID 4640 wrote to memory of 616	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	5
PID 4640 wrote to memory of 616	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	5
PID 4640 wrote to memory of 616	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	5
PID 4640 wrote to memory of 616	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	5
PID 4640 wrote to memory of 668	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	3
PID 4640 wrote to memory of 668	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	3
PID 4640 wrote to memory of 668	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	3
PID 4640 wrote to memory of 668	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	3
PID 4640 wrote to memory of 668	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	3
PID 4640 wrote to memory of 668	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	3
PID 4640 wrote to memory of 784	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	9
PID 4640 wrote to memory of 784	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	9
PID 4640 wrote to memory of 784	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	9
PID 4640 wrote to memory of 784	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	9
PID 4640 wrote to memory of 784	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	9
PID 4640 wrote to memory of 784	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	9
PID 4640 wrote to memory of 792	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	8
PID 4640 wrote to memory of 792	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	8
PID 4640 wrote to memory of 792	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	8
PID 4640 wrote to memory of 792	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	8
PID 4640 wrote to memory of 792	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	8
PID 4640 wrote to memory of 792	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	8
PID 4640 wrote to memory of 800	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	13
PID 4640 wrote to memory of 800	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	13
PID 4640 wrote to memory of 800	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	13
PID 4640 wrote to memory of 800	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	13
PID 4640 wrote to memory of 800	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	13
PID 4640 wrote to memory of 800	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	13
PID 4640 wrote to memory of 908	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	12
PID 4640 wrote to memory of 908	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	12
PID 4640 wrote to memory of 908	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	12
PID 4640 wrote to memory of 908	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	12
PID 4640 wrote to memory of 908	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	12
PID 4640 wrote to memory of 908	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	12
PID 4640 wrote to memory of 956	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	11
PID 4640 wrote to memory of 956	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	11
PID 4640 wrote to memory of 956	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	11
PID 4640 wrote to memory of 956	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	11
PID 4640 wrote to memory of 956	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	11
PID 4640 wrote to memory of 956	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	11
PID 4640 wrote to memory of 372	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	10
PID 4640 wrote to memory of 372	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	10
PID 4640 wrote to memory of 372	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	10
PID 4640 wrote to memory of 372	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	10
PID 4640 wrote to memory of 372	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	10
PID 4640 wrote to memory of 372	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	10
PID 4640 wrote to memory of 436	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	14
PID 4640 wrote to memory of 436	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	14
PID 4640 wrote to memory of 436	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	14
PID 4640 wrote to memory of 436	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	14
PID 4640 wrote to memory of 436	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	14
PID 4640 wrote to memory of 436	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	14
PID 4640 wrote to memory of 752	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	78
PID 4640 wrote to memory of 752	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	78
PID 4640 wrote to memory of 752	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	78
PID 4640 wrote to memory of 752	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	78
PID 4640 wrote to memory of 752	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	78
PID 4640 wrote to memory of 752	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	78
PID 4640 wrote to memory of 1000	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	15
PID 4640 wrote to memory of 1000	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	15
PID 4640 wrote to memory of 1000	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	15
PID 4640 wrote to memory of 1000	4640	2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe	15

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:792
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3440
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3380
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3316
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3216
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4836
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:2056
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4692
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3820
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1104
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1248
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1328

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3064
- C:\Users\Admin\AppData\Local\Temp\2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe
  "C:\Users\Admin\AppData\Local\Temp\2430c727416412812c20ff5b64bc8c7186c34d1a7dc3eec060ee8084ab1c718c.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 936
    3⤵
    - Program crash
    PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2672

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2128

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4640 -ip 4640
1⤵
PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4640-132-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4640-133-0x0000000009000000-0x0000000009009000-memory.dmp

Filesize
36KB

Download
memory/4640-134-0x0000000070000000-0x000000007000B000-memory.dmp

Filesize
44KB

Download
memory/4640-135-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download