5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9

Analysis

max time kernel
98s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
Size

51KB
MD5

02070f7650d67d6dd260b308b99bf2e0
SHA1

b874177ce79a4ea1d19696c0028145f78673a624
SHA256

5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9
SHA512

a39d8b7207ceb63180b5c7ea2332f05b8eff327dbe643bf4aafdb7520835565f56aabbf3e508a2ec3daf185da74b409f6c2b1e8151247ca14543018b2f1487cf
SSDEEP

1536:ImxOYd5ua0kaIC2Hv0Uh7uxUdOpk/2IgebwKY:uYd5R03ICq0eoUdOpMwKY

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 604	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	5
PID 5028 wrote to memory of 604	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	5
PID 5028 wrote to memory of 604	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	5
PID 5028 wrote to memory of 604	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	5
PID 5028 wrote to memory of 604	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	5
PID 5028 wrote to memory of 604	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	5
PID 5028 wrote to memory of 660	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	3
PID 5028 wrote to memory of 660	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	3
PID 5028 wrote to memory of 660	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	3
PID 5028 wrote to memory of 660	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	3
PID 5028 wrote to memory of 660	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	3
PID 5028 wrote to memory of 660	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	3
PID 5028 wrote to memory of 772	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	8
PID 5028 wrote to memory of 772	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	8
PID 5028 wrote to memory of 772	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	8
PID 5028 wrote to memory of 772	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	8
PID 5028 wrote to memory of 772	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	8
PID 5028 wrote to memory of 772	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	8
PID 5028 wrote to memory of 780	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	13
PID 5028 wrote to memory of 780	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	13
PID 5028 wrote to memory of 780	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	13
PID 5028 wrote to memory of 780	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	13
PID 5028 wrote to memory of 780	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	13
PID 5028 wrote to memory of 780	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	13
PID 5028 wrote to memory of 784	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	12
PID 5028 wrote to memory of 784	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	12
PID 5028 wrote to memory of 784	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	12
PID 5028 wrote to memory of 784	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	12
PID 5028 wrote to memory of 784	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	12
PID 5028 wrote to memory of 784	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	12
PID 5028 wrote to memory of 884	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	11
PID 5028 wrote to memory of 884	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	11
PID 5028 wrote to memory of 884	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	11
PID 5028 wrote to memory of 884	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	11
PID 5028 wrote to memory of 884	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	11
PID 5028 wrote to memory of 884	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	11
PID 5028 wrote to memory of 940	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	10
PID 5028 wrote to memory of 940	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	10
PID 5028 wrote to memory of 940	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	10
PID 5028 wrote to memory of 940	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	10
PID 5028 wrote to memory of 940	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	10
PID 5028 wrote to memory of 940	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	10
PID 5028 wrote to memory of 1016	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	9
PID 5028 wrote to memory of 1016	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	9
PID 5028 wrote to memory of 1016	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	9
PID 5028 wrote to memory of 1016	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	9
PID 5028 wrote to memory of 1016	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	9
PID 5028 wrote to memory of 1016	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	9
PID 5028 wrote to memory of 428	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	19
PID 5028 wrote to memory of 428	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	19
PID 5028 wrote to memory of 428	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	19
PID 5028 wrote to memory of 428	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	19
PID 5028 wrote to memory of 428	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	19
PID 5028 wrote to memory of 428	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	19
PID 5028 wrote to memory of 680	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	18
PID 5028 wrote to memory of 680	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	18
PID 5028 wrote to memory of 680	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	18
PID 5028 wrote to memory of 680	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	18
PID 5028 wrote to memory of 680	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	18
PID 5028 wrote to memory of 680	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	18
PID 5028 wrote to memory of 612	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	14
PID 5028 wrote to memory of 612	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	14
PID 5028 wrote to memory of 612	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	14
PID 5028 wrote to memory of 612	5028	5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe	14

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3424
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3356
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3268
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3280
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4092
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1932
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1740
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4760
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4464
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3808
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1700

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1996

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2736
- C:\Users\Admin\AppData\Local\Temp\5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe
  "C:\Users\Admin\AppData\Local\Temp\5c3690a75626e2e6ed2cd423cfd8837cea0418c29d97f16d55e11edbb2aca1f9.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2524

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5028-132-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download