Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-04-2021 05:32
Static task
static1
Behavioral task
behavioral1
Sample
TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
Resource
win7v20210408
General
-
Target
TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
-
Size
260KB
-
MD5
84bc6ece04588d297e5f957f8c0eed1a
-
SHA1
47b0cfaaef2a8dceeb377e822094fd8a97b6fc0b
-
SHA256
d9c227ed57ca134b518a38f74580faf7f3c5e05c5caae3ed3166641341950ee7
-
SHA512
83c546bebebe502a4239c18e29230dec4a3df29568ff97cec6b64fa00801b2572ee738b0f74d9a11f693fff34f6b23db8edbfc16a4b5baa1482ff604314600f1
Malware Config
Extracted
remcos
188.72.124.143:2858
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrpid process 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr -
Suspicious use of SetThreadContext 64 IoCs
Processes:
TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrapplaunch.exedescription pid process target process PID 2116 set thread context of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 1004 set thread context of 3548 1004 applaunch.exe svchost.exe PID 1004 set thread context of 848 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4060 1004 applaunch.exe svchost.exe PID 1004 set thread context of 940 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2624 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3396 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3824 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2736 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3460 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2948 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2616 1004 applaunch.exe svchost.exe PID 1004 set thread context of 432 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4028 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2136 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3736 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2276 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2240 1004 applaunch.exe svchost.exe PID 1004 set thread context of 1000 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3168 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3004 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4084 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2288 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2776 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3404 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2148 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2472 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3780 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2828 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3720 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4044 1004 applaunch.exe svchost.exe PID 1004 set thread context of 692 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3732 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2752 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3508 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2220 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3356 1004 applaunch.exe svchost.exe PID 1004 set thread context of 1200 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3748 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4088 1004 applaunch.exe svchost.exe PID 1004 set thread context of 856 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3952 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2184 1004 applaunch.exe svchost.exe PID 1004 set thread context of 652 1004 applaunch.exe svchost.exe PID 1004 set thread context of 1296 1004 applaunch.exe svchost.exe PID 1004 set thread context of 1304 1004 applaunch.exe svchost.exe PID 1004 set thread context of 2756 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4052 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3932 1004 applaunch.exe svchost.exe PID 1004 set thread context of 1212 1004 applaunch.exe svchost.exe PID 1004 set thread context of 3972 1004 applaunch.exe svchost.exe PID 1004 set thread context of 1772 1004 applaunch.exe svchost.exe PID 1004 set thread context of 504 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4120 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4148 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4176 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4204 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4236 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4260 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4292 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4316 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4340 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4368 1004 applaunch.exe svchost.exe PID 1004 set thread context of 4388 1004 applaunch.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1856 2116 WerFault.exe TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1464 timeout.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrWerFault.exepid process 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrWerFault.exedescription pid process Token: SeDebugPrivilege 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr Token: SeRestorePrivilege 1856 WerFault.exe Token: SeBackupPrivilege 1856 WerFault.exe Token: SeDebugPrivilege 1856 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrcmd.exeapplaunch.exedescription pid process target process PID 2116 wrote to memory of 3752 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr cmd.exe PID 2116 wrote to memory of 3752 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr cmd.exe PID 2116 wrote to memory of 3752 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr cmd.exe PID 3752 wrote to memory of 1464 3752 cmd.exe timeout.exe PID 3752 wrote to memory of 1464 3752 cmd.exe timeout.exe PID 3752 wrote to memory of 1464 3752 cmd.exe timeout.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 2116 wrote to memory of 1004 2116 TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr applaunch.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3548 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3764 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3764 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3764 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 848 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 4060 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3840 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3840 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 3840 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe PID 1004 wrote to memory of 940 1004 applaunch.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr"C:\Users\Admin\AppData\Local\Temp\TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr" /S1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 18842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-162-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/432-161-0x000000000040F2B0-mapping.dmp
-
memory/504-282-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/504-281-0x000000000040F2B0-mapping.dmp
-
memory/652-255-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/652-254-0x000000000040F2B0-mapping.dmp
-
memory/692-218-0x000000000040F2B0-mapping.dmp
-
memory/692-219-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/848-132-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/848-131-0x000000000040F2B0-mapping.dmp
-
memory/856-246-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/856-245-0x000000000040F2B0-mapping.dmp
-
memory/940-138-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/940-137-0x000000000040F2B0-mapping.dmp
-
memory/1000-180-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1000-179-0x000000000040F2B0-mapping.dmp
-
memory/1004-128-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1004-122-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1004-123-0x000000000042EEEF-mapping.dmp
-
memory/1200-237-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1200-236-0x000000000040F2B0-mapping.dmp
-
memory/1212-272-0x000000000040F2B0-mapping.dmp
-
memory/1212-273-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1296-257-0x000000000040F2B0-mapping.dmp
-
memory/1296-258-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1304-260-0x000000000040F2B0-mapping.dmp
-
memory/1304-261-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1464-121-0x0000000000000000-mapping.dmp
-
memory/1772-279-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1772-278-0x000000000040F2B0-mapping.dmp
-
memory/2116-118-0x0000000004C40000-0x000000000513E000-memory.dmpFilesize
5.0MB
-
memory/2116-119-0x00000000025D0000-0x0000000002650000-memory.dmpFilesize
512KB
-
memory/2116-117-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/2116-114-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/2116-116-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/2136-167-0x000000000040F2B0-mapping.dmp
-
memory/2136-168-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2148-200-0x000000000040F2B0-mapping.dmp
-
memory/2148-201-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2184-252-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2184-251-0x000000000040F2B0-mapping.dmp
-
memory/2220-231-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2220-230-0x000000000040F2B0-mapping.dmp
-
memory/2240-176-0x000000000040F2B0-mapping.dmp
-
memory/2240-177-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2276-174-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2276-173-0x000000000040F2B0-mapping.dmp
-
memory/2288-191-0x000000000040F2B0-mapping.dmp
-
memory/2288-192-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2472-204-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2472-203-0x000000000040F2B0-mapping.dmp
-
memory/2616-159-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2616-158-0x000000000040F2B0-mapping.dmp
-
memory/2624-140-0x000000000040F2B0-mapping.dmp
-
memory/2624-141-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2736-149-0x000000000040F2B0-mapping.dmp
-
memory/2736-150-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2752-225-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2752-224-0x000000000040F2B0-mapping.dmp
-
memory/2756-263-0x000000000040F2B0-mapping.dmp
-
memory/2756-264-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2776-194-0x000000000040F2B0-mapping.dmp
-
memory/2776-195-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2828-209-0x000000000040F2B0-mapping.dmp
-
memory/2828-210-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2948-155-0x000000000040F2B0-mapping.dmp
-
memory/2948-156-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3004-185-0x000000000040F2B0-mapping.dmp
-
memory/3004-186-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3168-183-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3168-182-0x000000000040F2B0-mapping.dmp
-
memory/3356-233-0x000000000040F2B0-mapping.dmp
-
memory/3356-234-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3396-143-0x000000000040F2B0-mapping.dmp
-
memory/3396-144-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3404-198-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3404-197-0x000000000040F2B0-mapping.dmp
-
memory/3460-153-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3460-152-0x000000000040F2B0-mapping.dmp
-
memory/3508-227-0x000000000040F2B0-mapping.dmp
-
memory/3508-228-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3548-126-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3548-129-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3548-127-0x000000000040F2B0-mapping.dmp
-
memory/3720-212-0x000000000040F2B0-mapping.dmp
-
memory/3720-213-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3732-222-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3732-221-0x000000000040F2B0-mapping.dmp
-
memory/3736-170-0x000000000040F2B0-mapping.dmp
-
memory/3736-171-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3748-239-0x000000000040F2B0-mapping.dmp
-
memory/3748-240-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3752-120-0x0000000000000000-mapping.dmp
-
memory/3780-206-0x000000000040F2B0-mapping.dmp
-
memory/3780-207-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3824-147-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3824-146-0x000000000040F2B0-mapping.dmp
-
memory/3932-269-0x000000000040F2B0-mapping.dmp
-
memory/3932-270-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3952-249-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3952-248-0x000000000040F2B0-mapping.dmp
-
memory/3972-275-0x000000000040F2B0-mapping.dmp
-
memory/3972-276-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4028-164-0x000000000040F2B0-mapping.dmp
-
memory/4028-165-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4044-215-0x000000000040F2B0-mapping.dmp
-
memory/4044-216-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4052-267-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4052-266-0x000000000040F2B0-mapping.dmp
-
memory/4060-135-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4060-134-0x000000000040F2B0-mapping.dmp
-
memory/4084-188-0x000000000040F2B0-mapping.dmp
-
memory/4084-189-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4088-243-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4088-242-0x000000000040F2B0-mapping.dmp
-
memory/4120-284-0x000000000040F2B0-mapping.dmp
-
memory/4120-285-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4148-287-0x000000000040F2B0-mapping.dmp
-
memory/4148-288-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4176-290-0x000000000040F2B0-mapping.dmp
-
memory/4176-291-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4204-294-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4204-293-0x000000000040F2B0-mapping.dmp
-
memory/4236-295-0x000000000040F2B0-mapping.dmp
-
memory/4236-296-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4260-297-0x000000000040F2B0-mapping.dmp
-
memory/4260-298-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4292-299-0x000000000040F2B0-mapping.dmp
-
memory/4292-300-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4316-301-0x000000000040F2B0-mapping.dmp
-
memory/4316-302-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4340-303-0x000000000040F2B0-mapping.dmp
-
memory/4340-304-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4368-305-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB