7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9

Analysis

max time kernel
149s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
Size

236KB
MD5

c6e3492e3acfdb4b15ffc89c9ce2ee9a
SHA1

b274546bc15d546490303e92b4fbd5c15e7d98dc
SHA256

7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9
SHA512

5e032f4a98d58e3c3174741f563b18751cc459d4f6b487af1fc281287e419b0a702506523c4b5a912822ced83b3565d5359ed6748dbcef1cd31df30b34e77efd
SSDEEP

6144:J49gd3C8xsfgwQJatSYeDVnO1+W5nsNsemvzn6:qS38owu1YMVnO1T5nsNslbn

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe:*:enabled:@shell32.dll,-1"	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	2836	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 604	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	6
PID 2836 wrote to memory of 604	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	6
PID 2836 wrote to memory of 604	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	6
PID 2836 wrote to memory of 604	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	6
PID 2836 wrote to memory of 604	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	6
PID 2836 wrote to memory of 604	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	6
PID 2836 wrote to memory of 656	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	4
PID 2836 wrote to memory of 656	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	4
PID 2836 wrote to memory of 656	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	4
PID 2836 wrote to memory of 656	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	4
PID 2836 wrote to memory of 656	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	4
PID 2836 wrote to memory of 656	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	4
PID 2836 wrote to memory of 764	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	8
PID 2836 wrote to memory of 764	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	8
PID 2836 wrote to memory of 764	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	8
PID 2836 wrote to memory of 764	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	8
PID 2836 wrote to memory of 764	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	8
PID 2836 wrote to memory of 764	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	8
PID 2836 wrote to memory of 776	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	23
PID 2836 wrote to memory of 776	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	23
PID 2836 wrote to memory of 776	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	23
PID 2836 wrote to memory of 776	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	23
PID 2836 wrote to memory of 776	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	23
PID 2836 wrote to memory of 776	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	23
PID 2836 wrote to memory of 784	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	22
PID 2836 wrote to memory of 784	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	22
PID 2836 wrote to memory of 784	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	22
PID 2836 wrote to memory of 784	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	22
PID 2836 wrote to memory of 784	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	22
PID 2836 wrote to memory of 784	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	22
PID 2836 wrote to memory of 884	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	21
PID 2836 wrote to memory of 884	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	21
PID 2836 wrote to memory of 884	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	21
PID 2836 wrote to memory of 884	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	21
PID 2836 wrote to memory of 884	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	21
PID 2836 wrote to memory of 884	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	21
PID 2836 wrote to memory of 936	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	10
PID 2836 wrote to memory of 936	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	10
PID 2836 wrote to memory of 936	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	10
PID 2836 wrote to memory of 936	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	10
PID 2836 wrote to memory of 936	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	10
PID 2836 wrote to memory of 936	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	10
PID 2836 wrote to memory of 1008	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	9
PID 2836 wrote to memory of 1008	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	9
PID 2836 wrote to memory of 1008	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	9
PID 2836 wrote to memory of 1008	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	9
PID 2836 wrote to memory of 1008	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	9
PID 2836 wrote to memory of 1008	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	9
PID 2836 wrote to memory of 424	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	11
PID 2836 wrote to memory of 424	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	11
PID 2836 wrote to memory of 424	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	11
PID 2836 wrote to memory of 424	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	11
PID 2836 wrote to memory of 424	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	11
PID 2836 wrote to memory of 424	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	11
PID 2836 wrote to memory of 724	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	20
PID 2836 wrote to memory of 724	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	20
PID 2836 wrote to memory of 724	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	20
PID 2836 wrote to memory of 724	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	20
PID 2836 wrote to memory of 724	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	20
PID 2836 wrote to memory of 724	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	20
PID 2836 wrote to memory of 676	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	19
PID 2836 wrote to memory of 676	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	19
PID 2836 wrote to memory of 676	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	19
PID 2836 wrote to memory of 676	2836	7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe	19

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:656

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:764
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4704
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4488
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3792
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3512
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3424
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3360
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2000
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2828
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4012
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2044
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:5044
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1092
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1400
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2836 -ip 2836
  2⤵
  PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2700
- C:\Users\Admin\AppData\Local\Temp\7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe
  "C:\Users\Admin\AppData\Local\Temp\7863f1334d6b720718cf53a867b3890e380fbec2268c648643dc0e3f2141b2b9.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 520
    3⤵
    - Program crash
    PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2420

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2836-132-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2836-133-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download