9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259

Analysis

max time kernel
171s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
Size

350KB
MD5

4306739239bd46d3d09d71595b3aa524
SHA1

18ebf1361517ae97262c24aad9c9faca63204333
SHA256

9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259
SHA512

9aa64bf7e9106bfb9d3dec1c40319baef6f57efb44ca0c604ba67d0cee25eacf862a23720bc4d137ff01787b733e17092a17ffe92ee185c614e9b162db92ee00
SSDEEP

6144:QKzkrWCmp3mBBKVUrhSmAbxrKihFskD43OZVdRQ/vqkg1gEagdT6VnqT:QjHS3m/VrHuxLhmkD4cV7uikFg2nqT

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe:*:enabled:@shell32.dll,-1"	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	4856	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 580	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	5
PID 4856 wrote to memory of 580	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	5
PID 4856 wrote to memory of 580	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	5
PID 4856 wrote to memory of 580	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	5
PID 4856 wrote to memory of 580	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	5
PID 4856 wrote to memory of 580	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	5
PID 4856 wrote to memory of 668	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	6
PID 4856 wrote to memory of 668	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	6
PID 4856 wrote to memory of 668	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	6
PID 4856 wrote to memory of 668	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	6
PID 4856 wrote to memory of 668	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	6
PID 4856 wrote to memory of 668	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	6
PID 4856 wrote to memory of 764	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	8
PID 4856 wrote to memory of 764	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	8
PID 4856 wrote to memory of 764	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	8
PID 4856 wrote to memory of 764	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	8
PID 4856 wrote to memory of 764	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	8
PID 4856 wrote to memory of 764	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	8
PID 4856 wrote to memory of 772	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	20
PID 4856 wrote to memory of 772	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	20
PID 4856 wrote to memory of 772	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	20
PID 4856 wrote to memory of 772	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	20
PID 4856 wrote to memory of 772	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	20
PID 4856 wrote to memory of 772	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	20
PID 4856 wrote to memory of 780	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	19
PID 4856 wrote to memory of 780	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	19
PID 4856 wrote to memory of 780	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	19
PID 4856 wrote to memory of 780	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	19
PID 4856 wrote to memory of 780	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	19
PID 4856 wrote to memory of 780	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	19
PID 4856 wrote to memory of 884	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	18
PID 4856 wrote to memory of 884	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	18
PID 4856 wrote to memory of 884	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	18
PID 4856 wrote to memory of 884	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	18
PID 4856 wrote to memory of 884	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	18
PID 4856 wrote to memory of 884	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	18
PID 4856 wrote to memory of 936	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	17
PID 4856 wrote to memory of 936	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	17
PID 4856 wrote to memory of 936	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	17
PID 4856 wrote to memory of 936	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	17
PID 4856 wrote to memory of 936	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	17
PID 4856 wrote to memory of 936	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	17
PID 4856 wrote to memory of 1008	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	9
PID 4856 wrote to memory of 1008	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	9
PID 4856 wrote to memory of 1008	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	9
PID 4856 wrote to memory of 1008	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	9
PID 4856 wrote to memory of 1008	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	9
PID 4856 wrote to memory of 1008	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	9
PID 4856 wrote to memory of 460	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	16
PID 4856 wrote to memory of 460	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	16
PID 4856 wrote to memory of 460	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	16
PID 4856 wrote to memory of 460	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	16
PID 4856 wrote to memory of 460	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	16
PID 4856 wrote to memory of 460	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	16
PID 4856 wrote to memory of 384	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	10
PID 4856 wrote to memory of 384	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	10
PID 4856 wrote to memory of 384	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	10
PID 4856 wrote to memory of 384	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	10
PID 4856 wrote to memory of 384	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	10
PID 4856 wrote to memory of 384	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	10
PID 4856 wrote to memory of 848	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	11
PID 4856 wrote to memory of 848	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	11
PID 4856 wrote to memory of 848	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	11
PID 4856 wrote to memory of 848	4856	9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe	11

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:580
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:772

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1092
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3436
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3508
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3740
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4388
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3596
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3344
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:868
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1296
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2384

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:1944

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1084
- C:\Users\Admin\AppData\Local\Temp\9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe
  "C:\Users\Admin\AppData\Local\Temp\9d6864910eb812548c160842e0051980bd49f79638cbbe644a17185635024259.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 896
    3⤵
    - Program crash
    PID:3640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4856 -ip 4856
  2⤵
  PID:4800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:1192

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4856-134-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/4856-135-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download