c2e8eab84c23134e367654536c0e40144e4c1c7ad5aaa09443dca439203bfca6

Analysis

max time kernel
13s
max time network
113s
platform
windows10_x64
resource
win10v20210408
submitted
20-04-2021 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
Size

96KB
MD5

c2162c5414dbfbf711552f8d2380d5e2
SHA1

665bb4edc2a067145f1ea0883532f9eac321628a
SHA256

684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab
SHA512

6965653765077d407028afb22c73b9011de9966f1b42bd04081c285e4254f7bf0a6ddad0cfa9c080e7eb0a91b7a0494859c56db0b6b44faa7924bd5832d03f36

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe

pid	process
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe

Suspicious behavior: MapViewOfSection 59 IoCs

Processes:

684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe

pid	process
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe

description pid process

Token: SeDebugPrivilege 4024 684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe

description	pid	process
Token: SeDebugPrivilege	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe

description	pid	process	target process
PID 4024 wrote to memory of 548	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	winlogon.exe
PID 4024 wrote to memory of 548	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	winlogon.exe
PID 4024 wrote to memory of 548	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	winlogon.exe
PID 4024 wrote to memory of 548	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	winlogon.exe
PID 4024 wrote to memory of 548	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	winlogon.exe
PID 4024 wrote to memory of 548	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	winlogon.exe
PID 4024 wrote to memory of 628	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	lsass.exe
PID 4024 wrote to memory of 628	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	lsass.exe
PID 4024 wrote to memory of 628	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	lsass.exe
PID 4024 wrote to memory of 628	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	lsass.exe
PID 4024 wrote to memory of 628	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	lsass.exe
PID 4024 wrote to memory of 628	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	lsass.exe
PID 4024 wrote to memory of 708	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 708	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 708	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 708	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 708	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 708	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 716	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 716	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 716	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 716	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 716	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 716	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	fontdrvhost.exe
PID 4024 wrote to memory of 724	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 724	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 724	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 724	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 724	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 724	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 792	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 792	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 792	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 792	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 792	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 792	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 840	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 840	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 840	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 840	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 840	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 840	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 888	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 888	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 888	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 888	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 888	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 888	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 968	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	dwm.exe
PID 4024 wrote to memory of 968	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	dwm.exe
PID 4024 wrote to memory of 968	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	dwm.exe
PID 4024 wrote to memory of 968	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	dwm.exe
PID 4024 wrote to memory of 968	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	dwm.exe
PID 4024 wrote to memory of 968	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	dwm.exe
PID 4024 wrote to memory of 68	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 68	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 68	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 68	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 68	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 68	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 396	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 396	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 396	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe
PID 4024 wrote to memory of 396	4024	684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:628

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:548

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:968

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:708

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:716

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:724

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1268

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1156

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1316

c:\windows\system32\sihost.exe
sihost.exe
2⤵
PID:2344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1308

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1296

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1492

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1128

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1524

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1120

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1536

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1032

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3bc
2⤵
PID:2276

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1728

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1836

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1764

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2008

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1744

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:888

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:840

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:792

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
2⤵
PID:3264

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
2⤵
PID:3276

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3656

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3484

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:3352

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:1872

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2156

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2596

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2760

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2752

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:3880

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3024

C:\Users\Admin\AppData\Local\Temp\684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe
"C:\Users\Admin\AppData\Local\Temp\684f7a95584e49ee72624e94d79137b53e329d8ccc8909357d83b1a45fd0beab.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2744

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:3616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2352

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:736

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads