1456276133ab9643a2c681c116896a139da94f8708b26af9f1389e7dcb8a66ba

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
Size

98KB
MD5

070066885dd3141eac6cd795ad0639e0
SHA1

afdb2458f308c20f2738c3c9c77a34a3841e203d
SHA256

1456276133ab9643a2c681c116896a139da94f8708b26af9f1389e7dcb8a66ba
SHA512

604b939abe53ede25c0dd7d4fdd96dcefbab3c64a1d3a4a131ed1e6b010ff502e3e6a4f7cfde506a60548c4c3e6a6a553f03876a765b9e0d89bde9d0fb49e199
SSDEEP

1536:ODr9MzQ4srZR6ZvgVX2wdjV+qlmQPKLxueCEO5O5D:ODrKC1ggVGMHmQPDjd

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe:*:enabled:@shell32.dll,-1"	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 632	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	4
PID 2964 wrote to memory of 632	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	4
PID 2964 wrote to memory of 632	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	4
PID 2964 wrote to memory of 632	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	4
PID 2964 wrote to memory of 632	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	4
PID 2964 wrote to memory of 632	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	4
PID 2964 wrote to memory of 692	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	2
PID 2964 wrote to memory of 692	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	2
PID 2964 wrote to memory of 692	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	2
PID 2964 wrote to memory of 692	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	2
PID 2964 wrote to memory of 692	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	2
PID 2964 wrote to memory of 692	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	2
PID 2964 wrote to memory of 796	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	9
PID 2964 wrote to memory of 796	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	9
PID 2964 wrote to memory of 796	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	9
PID 2964 wrote to memory of 796	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	9
PID 2964 wrote to memory of 796	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	9
PID 2964 wrote to memory of 796	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	9
PID 2964 wrote to memory of 808	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	8
PID 2964 wrote to memory of 808	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	8
PID 2964 wrote to memory of 808	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	8
PID 2964 wrote to memory of 808	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	8
PID 2964 wrote to memory of 808	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	8
PID 2964 wrote to memory of 808	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	8
PID 2964 wrote to memory of 812	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	79
PID 2964 wrote to memory of 812	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	79
PID 2964 wrote to memory of 812	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	79
PID 2964 wrote to memory of 812	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	79
PID 2964 wrote to memory of 812	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	79
PID 2964 wrote to memory of 812	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	79
PID 2964 wrote to memory of 916	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	78
PID 2964 wrote to memory of 916	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	78
PID 2964 wrote to memory of 916	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	78
PID 2964 wrote to memory of 916	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	78
PID 2964 wrote to memory of 916	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	78
PID 2964 wrote to memory of 916	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	78
PID 2964 wrote to memory of 972	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	77
PID 2964 wrote to memory of 972	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	77
PID 2964 wrote to memory of 972	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	77
PID 2964 wrote to memory of 972	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	77
PID 2964 wrote to memory of 972	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	77
PID 2964 wrote to memory of 972	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	77
PID 2964 wrote to memory of 388	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	10
PID 2964 wrote to memory of 388	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	10
PID 2964 wrote to memory of 388	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	10
PID 2964 wrote to memory of 388	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	10
PID 2964 wrote to memory of 388	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	10
PID 2964 wrote to memory of 388	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	10
PID 2964 wrote to memory of 752	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	11
PID 2964 wrote to memory of 752	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	11
PID 2964 wrote to memory of 752	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	11
PID 2964 wrote to memory of 752	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	11
PID 2964 wrote to memory of 752	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	11
PID 2964 wrote to memory of 752	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	11
PID 2964 wrote to memory of 884	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	76
PID 2964 wrote to memory of 884	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	76
PID 2964 wrote to memory of 884	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	76
PID 2964 wrote to memory of 884	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	76
PID 2964 wrote to memory of 884	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	76
PID 2964 wrote to memory of 884	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	76
PID 2964 wrote to memory of 324	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	75
PID 2964 wrote to memory of 324	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	75
PID 2964 wrote to memory of 324	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	75
PID 2964 wrote to memory of 324	2964	NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe	75

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:808
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3728
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1896
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2984
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:2492
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4896
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4376
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4084
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3808
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3620
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3516
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2768
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:1484
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1344
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2056

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3292

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3140
- C:\Users\Admin\AppData\Local\Temp\NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.070066885dd3141eac6cd795ad0639e0_JC.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2672

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1848

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:916

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x0000000001000000-0x000000000101D000-memory.dmp

Filesize
116KB

Download
memory/2964-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/2964-2-0x0000000077632000-0x0000000077633000-memory.dmp

Filesize
4KB

Download
memory/2964-3-0x0000000077633000-0x0000000077634000-memory.dmp

Filesize
4KB

Download
memory/2964-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/2964-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/2964-7-0x0000000001000000-0x000000000101D000-memory.dmp

Filesize
116KB

Download