c2e8eab84c23134e367654536c0e40144e4c1c7ad5aaa09443dca439203bfca6

Analysis

max time kernel
13s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
20-04-2021 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
Size

407KB
MD5

4698544b9533d620f28d25ca14a8f92b
SHA1

bbe0896a3360084ea2cbd06f5a5780f7df3ad6f2
SHA256

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8
SHA512

af9d5a0db07c603534b28d18fe805a6cfa66969c0db74ceb4038ef0101acf2a0d7e7e3a781b1795084a89561d16021a645f6147850caefd31b04bb808e3f59ad

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1112 created 1824 1112 WerFault.exe 047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1112 1824 WerFault.exe 047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

description	pid	process	target process
PID 1112 created 1824	1112	WerFault.exe	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

pid	pid_target	process	target process
1112	1824	WerFault.exe	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exeWerFault.exe

pid	process
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe
1112	WerFault.exe

Suspicious behavior: MapViewOfSection 60 IoCs

Processes:

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

pid	process
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
Token: SeRestorePrivilege	1112	WerFault.exe
Token: SeBackupPrivilege	1112	WerFault.exe
Token: SeDebugPrivilege	1112	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

description	pid	process	target process
PID 1824 wrote to memory of 552	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1824 wrote to memory of 552	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1824 wrote to memory of 636	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1824 wrote to memory of 636	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1824 wrote to memory of 716	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 716	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 736	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 736	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 740	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	fontdrvhost.exe
PID 1824 wrote to memory of 804	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 804	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 856	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 896	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 984	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	dwm.exe
PID 1824 wrote to memory of 984	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	dwm.exe
PID 1824 wrote to memory of 1008	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 1008	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 480	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 480	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 480	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1824 wrote to memory of 480	1824	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:636

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:552

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:984

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:716

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1492

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1868

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2148

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2500

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2864

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3356

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:1840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:996

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3784

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3560

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3376

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2976

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
"C:\Users\Admin\AppData\Local\Temp\047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 428
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2680

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2600

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2592

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:3260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2584

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2576

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2568

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2488

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2320

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b8
1⤵
PID:2276

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1540

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2004

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1776

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1632

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1564

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1548

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1304

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1256

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1244

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1160

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1044

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:948

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:684

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:480

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1008

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:804

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2⤵
PID:4028

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:736

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:2616

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads