549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

Analysis

max time kernel
141s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
Size

69KB
MD5

a0131e61a6b4586f7d6d9a691a300b30
SHA1

cab0f13badba091696ca66a9ff3717cb1d127299
SHA256

549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378
SHA512

c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94
SSDEEP

1536:eDuhgWMN2OflimUCziRxCtZiFsyf+eHXaX4FSgYVq04W1emlYIpGG:eDmK2OflimUdfPD3aocVRPRlZGG

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
1344	hp-1003.exe
1104	hp-1003.exe
968	hp-1003.exe
1784	hp-1003.exe
916	hp-1003.exe
556	hp-1003.exe
1368	hp-1003.exe
1088	hp-1003.exe
996	hp-1003.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/856-55-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-56.dat	upx
behavioral1/files/0x0007000000005c50-57.dat	upx
behavioral1/files/0x0007000000005c50-59.dat	upx
behavioral1/files/0x0007000000005c50-61.dat	upx
behavioral1/memory/856-62-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/1344-63-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-64.dat	upx
behavioral1/files/0x0007000000005c50-65.dat	upx
behavioral1/files/0x0007000000005c50-67.dat	upx
behavioral1/memory/1104-71-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-72.dat	upx
behavioral1/files/0x0007000000005c50-73.dat	upx
behavioral1/files/0x0007000000005c50-75.dat	upx
behavioral1/memory/968-77-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-78.dat	upx
behavioral1/files/0x0007000000005c50-81.dat	upx
behavioral1/files/0x0007000000005c50-79.dat	upx
behavioral1/memory/1784-84-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-85.dat	upx
behavioral1/files/0x0007000000005c50-86.dat	upx
behavioral1/files/0x0007000000005c50-88.dat	upx
behavioral1/memory/916-90-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-91.dat	upx
behavioral1/files/0x0007000000005c50-92.dat	upx
behavioral1/files/0x0007000000005c50-94.dat	upx
behavioral1/memory/556-97-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-98.dat	upx
behavioral1/files/0x0007000000005c50-99.dat	upx
behavioral1/files/0x0007000000005c50-101.dat	upx
behavioral1/memory/1368-103-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-104.dat	upx
behavioral1/files/0x0007000000005c50-105.dat	upx
behavioral1/files/0x0007000000005c50-107.dat	upx
behavioral1/memory/1088-111-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-112.dat	upx
behavioral1/files/0x0007000000005c50-113.dat	upx
behavioral1/files/0x0007000000005c50-115.dat	upx
behavioral1/memory/996-117-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Loads dropped DLL 18 IoCs

pid	Process
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
1344	hp-1003.exe
1344	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
968	hp-1003.exe
968	hp-1003.exe
1784	hp-1003.exe
1784	hp-1003.exe
916	hp-1003.exe
916	hp-1003.exe
556	hp-1003.exe
556	hp-1003.exe
1368	hp-1003.exe
1368	hp-1003.exe
1088	hp-1003.exe
1088	hp-1003.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\EXPLORER.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\EXPLORER.EXE	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
File opened for modification	C:\WINDOWS\SYSWOW64\EXPLORER.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\EXPLORER.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\EXPLORER.EXE	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\EXPLORER.EXE	hp-1003.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\EXPLORER.EXE	hp-1003.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\EXPLORER.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SysWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
File opened for modification	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File created	C:\Windows\SysWOW64\hp-1003.exe	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\HP-1003.EXE	hp-1003.exe
File opened for modification	C:\WINDOWS\SYSWOW64\EXPLORER.EXE	hp-1003.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
1344	hp-1003.exe
1104	hp-1003.exe
968	hp-1003.exe
1784	hp-1003.exe
916	hp-1003.exe
556	hp-1003.exe
1368	hp-1003.exe
1088	hp-1003.exe
996	hp-1003.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1344	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
1104	hp-1003.exe
968	hp-1003.exe
968	hp-1003.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
Token: SeDebugPrivilege	1344	hp-1003.exe
Token: SeDebugPrivilege	1104	hp-1003.exe
Token: SeDebugPrivilege	968	hp-1003.exe
Token: SeDebugPrivilege	1784	hp-1003.exe
Token: SeDebugPrivilege	916	hp-1003.exe
Token: SeDebugPrivilege	556	hp-1003.exe
Token: SeDebugPrivilege	1368	hp-1003.exe
Token: SeDebugPrivilege	1088	hp-1003.exe
Token: SeDebugPrivilege	996	hp-1003.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 368	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	9
PID 856 wrote to memory of 368	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	9
PID 856 wrote to memory of 368	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	9
PID 856 wrote to memory of 376	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	8
PID 856 wrote to memory of 376	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	8
PID 856 wrote to memory of 376	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	8
PID 856 wrote to memory of 416	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	3
PID 856 wrote to memory of 416	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	3
PID 856 wrote to memory of 416	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	3
PID 856 wrote to memory of 460	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	2
PID 856 wrote to memory of 460	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	2
PID 856 wrote to memory of 460	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	2
PID 856 wrote to memory of 476	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	1
PID 856 wrote to memory of 476	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	1
PID 856 wrote to memory of 476	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	1
PID 856 wrote to memory of 484	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	4
PID 856 wrote to memory of 484	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	4
PID 856 wrote to memory of 484	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	4
PID 856 wrote to memory of 588	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	7
PID 856 wrote to memory of 588	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	7
PID 856 wrote to memory of 588	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	7
PID 856 wrote to memory of 664	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	6
PID 856 wrote to memory of 664	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	6
PID 856 wrote to memory of 664	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	6
PID 856 wrote to memory of 724	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	5
PID 856 wrote to memory of 724	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	5
PID 856 wrote to memory of 724	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	5
PID 856 wrote to memory of 792	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	22
PID 856 wrote to memory of 792	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	22
PID 856 wrote to memory of 792	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	22
PID 856 wrote to memory of 832	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	21
PID 856 wrote to memory of 832	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	21
PID 856 wrote to memory of 832	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	21
PID 856 wrote to memory of 868	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	20
PID 856 wrote to memory of 868	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	20
PID 856 wrote to memory of 868	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	20
PID 856 wrote to memory of 300	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	10
PID 856 wrote to memory of 300	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	10
PID 856 wrote to memory of 300	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	10
PID 856 wrote to memory of 1012	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	19
PID 856 wrote to memory of 1012	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	19
PID 856 wrote to memory of 1012	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	19
PID 856 wrote to memory of 380	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	16
PID 856 wrote to memory of 380	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	16
PID 856 wrote to memory of 380	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	16
PID 856 wrote to memory of 1148	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	15
PID 856 wrote to memory of 1148	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	15
PID 856 wrote to memory of 1148	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	15
PID 856 wrote to memory of 1224	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	14
PID 856 wrote to memory of 1224	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	14
PID 856 wrote to memory of 1224	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	14
PID 856 wrote to memory of 1260	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	13
PID 856 wrote to memory of 1260	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	13
PID 856 wrote to memory of 1260	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	13
PID 856 wrote to memory of 1712	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	12
PID 856 wrote to memory of 1712	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	12
PID 856 wrote to memory of 1712	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	12
PID 856 wrote to memory of 1940	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	18
PID 856 wrote to memory of 1940	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	18
PID 856 wrote to memory of 1940	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	18
PID 856 wrote to memory of 1344	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	26
PID 856 wrote to memory of 1344	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	26
PID 856 wrote to memory of 1344	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	26
PID 856 wrote to memory of 1344	856	549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe	26

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:724
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:664
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:300
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1712
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1148
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:380
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1940
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1012
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:868
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:832
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:792

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe
  "C:\Users\Admin\AppData\Local\Temp\549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\hp-1003.exe
    C:\Windows\system32\hp-1003.exe 516 "C:\Users\Admin\AppData\Local\Temp\549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
  - - C:\Windows\SysWOW64\hp-1003.exe
      C:\Windows\system32\hp-1003.exe 512 "C:\Windows\SysWOW64\hp-1003.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1104
    - - C:\Windows\SysWOW64\hp-1003.exe
        
        C:\Windows\system32\hp-1003.exe 536 "C:\Windows\SysWOW64\hp-1003.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
      - C:\Windows\SysWOW64\hp-1003.exe
        
        C:\Windows\system32\hp-1003.exe 508 "C:\Windows\SysWOW64\hp-1003.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
        
        C:\Windows\SysWOW64\hp-1003.exe
        
        C:\Windows\system32\hp-1003.exe 544 "C:\Windows\SysWOW64\hp-1003.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
        
        C:\Windows\SysWOW64\hp-1003.exe
        
        C:\Windows\system32\hp-1003.exe 524 "C:\Windows\SysWOW64\hp-1003.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
        
        C:\Windows\SysWOW64\hp-1003.exe
        
        C:\Windows\system32\hp-1003.exe 540 "C:\Windows\SysWOW64\hp-1003.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
        
        C:\Windows\SysWOW64\hp-1003.exe
        
        C:\Windows\system32\hp-1003.exe 528 "C:\Windows\SysWOW64\hp-1003.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
        
        C:\Windows\SysWOW64\hp-1003.exe
        
        C:\Windows\system32\hp-1003.exe 560 "C:\Windows\SysWOW64\hp-1003.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:996

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
C:\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
\Windows\SysWOW64\hp-1003.exe

Filesize
69KB

MD5
a0131e61a6b4586f7d6d9a691a300b30

SHA1
cab0f13badba091696ca66a9ff3717cb1d127299

SHA256
549c7384663e004d8ab139f31227359adf980276bdf0ace974216c27e0faf378

SHA512
c6de94ef45d35916363ac24f81f4d7f7386d3152c04219e7f245688df13390ffe85a4914ad5f092a63e5ea884848655a0ee1b0bf324ad2c4656ffbbe109ffa94

Download Submit
memory/556-97-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/856-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/856-62-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/856-55-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/916-96-0x0000000002480000-0x00000000024CF000-memory.dmp

Filesize
316KB

Download
memory/916-90-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/968-83-0x0000000002450000-0x000000000249F000-memory.dmp

Filesize
316KB

Download
memory/968-77-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/996-117-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1088-111-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1104-71-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1344-69-0x0000000000450000-0x000000000049F000-memory.dmp

Filesize
316KB

Download
memory/1344-70-0x0000000000450000-0x000000000049F000-memory.dmp

Filesize
316KB

Download
memory/1344-63-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1368-109-0x0000000000450000-0x000000000049F000-memory.dmp

Filesize
316KB

Download
memory/1368-110-0x0000000000450000-0x000000000049F000-memory.dmp

Filesize
316KB

Download
memory/1368-103-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1784-84-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download