Analysis
- max time kernel
151s - max time network
53s - platform
windows7_x64 - resource
win7 - submitted
06/07/2020, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe
- Size 37KB
- Sample200706-58pdrde2an
- SHA256 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d
- MD5 e479b35f754ed7a7c2a4659d02ad955b
- SHA1 161ad375b47b72727d097c28593fd794dfa9e0b3
- SHA512 e8d8bc604b705d182411e9b1d5193bf55fe6425dd6fe1748096cfa0325f9052039d2c7e7cc7d5b759885e7b7c99ad2a133c6c783d3ca85d0a27f216b250a7c67
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 844 svhost.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 844 svhost.exe Token: SeDebugPrivilege 1532 taskkill.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe Token: 33 844 svhost.exe Token: SeIncBasePriorityPrivilege 844 svhost.exe - Suspicious behavior: EnumeratesProcesses 1377 IoCs
pid Process 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe 844 svhost.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\svhost.exe f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe File opened for modification C:\Windows\svhost.exe f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe File opened for modification C:\Windows\svhost.exe svhost.exe - Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1156 wrote to memory of 844 1156 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe 24 PID 1156 wrote to memory of 844 1156 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe 24 PID 1156 wrote to memory of 844 1156 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe 24 PID 1156 wrote to memory of 844 1156 f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe 24 PID 844 wrote to memory of 1456 844 svhost.exe 25 PID 844 wrote to memory of 1456 844 svhost.exe 25 PID 844 wrote to memory of 1456 844 svhost.exe 25 PID 844 wrote to memory of 1456 844 svhost.exe 25 PID 844 wrote to memory of 1532 844 svhost.exe 26 PID 844 wrote to memory of 1532 844 svhost.exe 26 PID 844 wrote to memory of 1532 844 svhost.exe 26 PID 844 wrote to memory of 1532 844 svhost.exe 26 - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 844 svhost.exe - Modifies Windows Firewall 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\700b09e0f8fdde9ce5346b9046e9ad95 = "\"C:\\Windows\\svhost.exe\" .." svhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\700b09e0f8fdde9ce5346b9046e9ad95 = "\"C:\\Windows\\svhost.exe\" .." svhost.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\700b09e0f8fdde9ce5346b9046e9ad95.exe svhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\700b09e0f8fdde9ce5346b9046e9ad95.exe svhost.exe - Kills process with taskkill 1 IoCs
pid Process 1532 taskkill.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe"C:\Users\Admin\AppData\Local\Temp\f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
- Adds Run entry to start application
- Drops startup file
PID:844 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svhost.exe" "svhost.exe" ENABLE3⤵
- Modifies service
PID:1456
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1532
-
-