5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5

General

Target

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
Size

62KB
MD5

16ae6a90471e520dec0b1c16acf90552
SHA1

b0d538c892185a328668c08648896ab3357b7f33
SHA256

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5
SHA512

39a9864589cb45c47c92fc87b17b694d93b2419dfabb7f79ba53a84c027f33afb992f72bd1dd16f76ae07e8be0733d36ad63194d4b07106a878ad689cb31ba03
SSDEEP

1536:aKdUJT2snaNU4O7Bn3ZoMguYCXwETUAUyBuVxi:a8qNnaLO7BnpoM0qJUy6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

pid	process
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

pid	process
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

description pid process

Token: SeDebugPrivilege 4624 5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

description	pid	process
Token: SeDebugPrivilege	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

description	pid	process	target process
PID 4624 wrote to memory of 604	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 4624 wrote to memory of 604	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 4624 wrote to memory of 604	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 4624 wrote to memory of 604	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 4624 wrote to memory of 604	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 4624 wrote to memory of 604	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 4624 wrote to memory of 664	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 4624 wrote to memory of 664	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 4624 wrote to memory of 664	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 4624 wrote to memory of 664	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 4624 wrote to memory of 664	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 4624 wrote to memory of 664	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 4624 wrote to memory of 756	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 756	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 756	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 756	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 756	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 756	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 760	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 760	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 760	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 760	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 760	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 760	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	fontdrvhost.exe
PID 4624 wrote to memory of 784	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 784	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 784	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 784	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 784	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 784	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 888	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 888	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 888	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 888	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 888	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 888	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 948	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 948	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 948	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 948	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 948	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 948	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 60	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	dwm.exe
PID 4624 wrote to memory of 60	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	dwm.exe
PID 4624 wrote to memory of 60	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	dwm.exe
PID 4624 wrote to memory of 60	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	dwm.exe
PID 4624 wrote to memory of 60	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	dwm.exe
PID 4624 wrote to memory of 60	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	dwm.exe
PID 4624 wrote to memory of 508	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 508	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 508	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 508	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 508	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 508	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 712	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 712	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 712	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 712	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 712	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 712	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 856	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 856	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 856	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 4624 wrote to memory of 856	4624	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:756
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3284
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3380
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3452
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3540
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3836
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4516
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4808
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4320
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1360
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2060

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2444

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2704

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:724
- C:\Users\Admin\AppData\Local\Temp\5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
  "C:\Users\Admin\AppData\Local\Temp\5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4624-132-0x0000000001000000-0x0000000001014000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads