51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
Size

52KB
MD5

b3aea99aab0ef88b81fb33f22beb5df9
SHA1

94f14e0988e9b809d15a41a68ec37738ee8b722c
SHA256

51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7
SHA512

eefa47970c16932e151acd59f159b7d88be7a4bae78da2d73a84c799ecce6e7aece1b3f9e49bafa645a27e45ad0826af6eaa98684382b37049147846471d62d8
SSDEEP

1536:/PprBmh/F9hSNfWyEPHp2XeFMwc3Tkta5o7+:prBmh/F9sli2XeFu34Ys

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe:*:enabled:@shell32.dll,-1"	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 584	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	2
PID 4636 wrote to memory of 584	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	2
PID 4636 wrote to memory of 584	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	2
PID 4636 wrote to memory of 584	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	2
PID 4636 wrote to memory of 584	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	2
PID 4636 wrote to memory of 584	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	2
PID 4636 wrote to memory of 664	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	7
PID 4636 wrote to memory of 664	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	7
PID 4636 wrote to memory of 664	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	7
PID 4636 wrote to memory of 664	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	7
PID 4636 wrote to memory of 664	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	7
PID 4636 wrote to memory of 664	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	7
PID 4636 wrote to memory of 776	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	8
PID 4636 wrote to memory of 776	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	8
PID 4636 wrote to memory of 776	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	8
PID 4636 wrote to memory of 776	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	8
PID 4636 wrote to memory of 776	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	8
PID 4636 wrote to memory of 776	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	8
PID 4636 wrote to memory of 784	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	27
PID 4636 wrote to memory of 784	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	27
PID 4636 wrote to memory of 784	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	27
PID 4636 wrote to memory of 784	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	27
PID 4636 wrote to memory of 784	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	27
PID 4636 wrote to memory of 784	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	27
PID 4636 wrote to memory of 792	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	26
PID 4636 wrote to memory of 792	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	26
PID 4636 wrote to memory of 792	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	26
PID 4636 wrote to memory of 792	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	26
PID 4636 wrote to memory of 792	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	26
PID 4636 wrote to memory of 792	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	26
PID 4636 wrote to memory of 904	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	25
PID 4636 wrote to memory of 904	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	25
PID 4636 wrote to memory of 904	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	25
PID 4636 wrote to memory of 904	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	25
PID 4636 wrote to memory of 904	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	25
PID 4636 wrote to memory of 904	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	25
PID 4636 wrote to memory of 952	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	24
PID 4636 wrote to memory of 952	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	24
PID 4636 wrote to memory of 952	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	24
PID 4636 wrote to memory of 952	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	24
PID 4636 wrote to memory of 952	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	24
PID 4636 wrote to memory of 952	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	24
PID 4636 wrote to memory of 312	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	9
PID 4636 wrote to memory of 312	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	9
PID 4636 wrote to memory of 312	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	9
PID 4636 wrote to memory of 312	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	9
PID 4636 wrote to memory of 312	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	9
PID 4636 wrote to memory of 312	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	9
PID 4636 wrote to memory of 520	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	10
PID 4636 wrote to memory of 520	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	10
PID 4636 wrote to memory of 520	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	10
PID 4636 wrote to memory of 520	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	10
PID 4636 wrote to memory of 520	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	10
PID 4636 wrote to memory of 520	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	10
PID 4636 wrote to memory of 752	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	19
PID 4636 wrote to memory of 752	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	19
PID 4636 wrote to memory of 752	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	19
PID 4636 wrote to memory of 752	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	19
PID 4636 wrote to memory of 752	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	19
PID 4636 wrote to memory of 752	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	19
PID 4636 wrote to memory of 948	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	11
PID 4636 wrote to memory of 948	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	11
PID 4636 wrote to memory of 948	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	11
PID 4636 wrote to memory of 948	4636	51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe	11

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1128
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1344
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:792
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3424
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3352
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3260
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4868
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3320
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4664
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1660
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:5084
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4744
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4548
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3736
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3508

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3048

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2084
- C:\Users\Admin\AppData\Local\Temp\51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe
  "C:\Users\Admin\AppData\Local\Temp\51ebd03e8f9aa86cb248c0b1295cbd1b716939b755c24f46997e7365f6108aa7.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2616

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2088

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-132-0x0000000001000000-0x0000000001011000-memory.dmp

Filesize
68KB

Download
memory/4636-133-0x0000000001000000-0x0000000001011000-memory.dmp

Filesize
68KB

Download