pid	Process
2956	svchost_dump_SCY - Copy.exe
2956	svchost_dump_SCY - Copy.exe
1688	taskeng.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getlog[1].htm	svchost.exe

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7D33897-E920-4B4C-BF10-C6A364CD478E}\82-f1-3d-f4-cb-9d	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f1-3d-f4-cb-9d	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7D33897-E920-4B4C-BF10-C6A364CD478E}\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7D33897-E920-4B4C-BF10-C6A364CD478E}\WpadDecisionTime = a05c3266458ada01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f1-3d-f4-cb-9d\WpadDecisionTime = a05c3266458ada01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f1-3d-f4-cb-9d\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7D33897-E920-4B4C-BF10-C6A364CD478E}\WpadNetworkName = "Network 3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0085000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f1-3d-f4-cb-9d\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7D33897-E920-4B4C-BF10-C6A364CD478E}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7D33897-E920-4B4C-BF10-C6A364CD478E}\WpadDecision = "0"	svchost.exe

pid	Process
2976	powershell.exe
2524	powershell.exe
2956	svchost_dump_SCY - Copy.exe
2144	powershell.exe
2240	powershell.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2472	WMIC.exe
Token: SeSecurityPrivilege	2472	WMIC.exe
Token: SeTakeOwnershipPrivilege	2472	WMIC.exe
Token: SeLoadDriverPrivilege	2472	WMIC.exe
Token: SeSystemProfilePrivilege	2472	WMIC.exe
Token: SeSystemtimePrivilege	2472	WMIC.exe
Token: SeProfSingleProcessPrivilege	2472	WMIC.exe
Token: SeIncBasePriorityPrivilege	2472	WMIC.exe
Token: SeCreatePagefilePrivilege	2472	WMIC.exe
Token: SeBackupPrivilege	2472	WMIC.exe
Token: SeRestorePrivilege	2472	WMIC.exe
Token: SeShutdownPrivilege	2472	WMIC.exe
Token: SeDebugPrivilege	2472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2472	WMIC.exe
Token: SeRemoteShutdownPrivilege	2472	WMIC.exe
Token: SeUndockPrivilege	2472	WMIC.exe
Token: SeManageVolumePrivilege	2472	WMIC.exe
Token: 33	2472	WMIC.exe
Token: 34	2472	WMIC.exe
Token: 35	2472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2472	WMIC.exe
Token: SeSecurityPrivilege	2472	WMIC.exe
Token: SeTakeOwnershipPrivilege	2472	WMIC.exe
Token: SeLoadDriverPrivilege	2472	WMIC.exe
Token: SeSystemProfilePrivilege	2472	WMIC.exe
Token: SeSystemtimePrivilege	2472	WMIC.exe
Token: SeProfSingleProcessPrivilege	2472	WMIC.exe
Token: SeIncBasePriorityPrivilege	2472	WMIC.exe
Token: SeCreatePagefilePrivilege	2472	WMIC.exe
Token: SeBackupPrivilege	2472	WMIC.exe
Token: SeRestorePrivilege	2472	WMIC.exe
Token: SeShutdownPrivilege	2472	WMIC.exe
Token: SeDebugPrivilege	2472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2472	WMIC.exe
Token: SeRemoteShutdownPrivilege	2472	WMIC.exe
Token: SeUndockPrivilege	2472	WMIC.exe
Token: SeManageVolumePrivilege	2472	WMIC.exe
Token: 33	2472	WMIC.exe
Token: 34	2472	WMIC.exe
Token: 35	2472	WMIC.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	WMIC.exe
Token: SeSecurityPrivilege	1492	WMIC.exe
Token: SeTakeOwnershipPrivilege	1492	WMIC.exe
Token: SeLoadDriverPrivilege	1492	WMIC.exe
Token: SeSystemProfilePrivilege	1492	WMIC.exe
Token: SeSystemtimePrivilege	1492	WMIC.exe
Token: SeProfSingleProcessPrivilege	1492	WMIC.exe
Token: SeIncBasePriorityPrivilege	1492	WMIC.exe
Token: SeCreatePagefilePrivilege	1492	WMIC.exe
Token: SeBackupPrivilege	1492	WMIC.exe
Token: SeRestorePrivilege	1492	WMIC.exe
Token: SeShutdownPrivilege	1492	WMIC.exe
Token: SeDebugPrivilege	1492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1492	WMIC.exe
Token: SeRemoteShutdownPrivilege	1492	WMIC.exe
Token: SeUndockPrivilege	1492	WMIC.exe
Token: SeManageVolumePrivilege	1492	WMIC.exe
Token: 33	1492	WMIC.exe
Token: 34	1492	WMIC.exe
Token: 35	1492	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1492	WMIC.exe
Token: SeSecurityPrivilege	1492	WMIC.exe

description	pid	Process	procid_target
PID 2956 wrote to memory of 2472	2956	svchost_dump_SCY - Copy.exe	29
PID 2956 wrote to memory of 2472	2956	svchost_dump_SCY - Copy.exe	29
PID 2956 wrote to memory of 2472	2956	svchost_dump_SCY - Copy.exe	29
PID 2956 wrote to memory of 2704	2956	svchost_dump_SCY - Copy.exe	31
PID 2956 wrote to memory of 2704	2956	svchost_dump_SCY - Copy.exe	31
PID 2956 wrote to memory of 2704	2956	svchost_dump_SCY - Copy.exe	31
PID 2956 wrote to memory of 2104	2956	svchost_dump_SCY - Copy.exe	32
PID 2956 wrote to memory of 2104	2956	svchost_dump_SCY - Copy.exe	32
PID 2956 wrote to memory of 2104	2956	svchost_dump_SCY - Copy.exe	32
PID 2956 wrote to memory of 2524	2956	svchost_dump_SCY - Copy.exe	35
PID 2956 wrote to memory of 2524	2956	svchost_dump_SCY - Copy.exe	35
PID 2956 wrote to memory of 2524	2956	svchost_dump_SCY - Copy.exe	35
PID 2956 wrote to memory of 2976	2956	svchost_dump_SCY - Copy.exe	37
PID 2956 wrote to memory of 2976	2956	svchost_dump_SCY - Copy.exe	37
PID 2956 wrote to memory of 2976	2956	svchost_dump_SCY - Copy.exe	37
PID 2956 wrote to memory of 2988	2956	svchost_dump_SCY - Copy.exe	41
PID 2956 wrote to memory of 2988	2956	svchost_dump_SCY - Copy.exe	41
PID 2956 wrote to memory of 2988	2956	svchost_dump_SCY - Copy.exe	41
PID 2956 wrote to memory of 2284	2956	svchost_dump_SCY - Copy.exe	43
PID 2956 wrote to memory of 2284	2956	svchost_dump_SCY - Copy.exe	43
PID 2956 wrote to memory of 2284	2956	svchost_dump_SCY - Copy.exe	43
PID 2956 wrote to memory of 1676	2956	svchost_dump_SCY - Copy.exe	45
PID 2956 wrote to memory of 1676	2956	svchost_dump_SCY - Copy.exe	45
PID 2956 wrote to memory of 1676	2956	svchost_dump_SCY - Copy.exe	45
PID 1676 wrote to memory of 1492	1676	svchost.exe	47
PID 1676 wrote to memory of 1492	1676	svchost.exe	47
PID 1676 wrote to memory of 1492	1676	svchost.exe	47
PID 1676 wrote to memory of 676	1676	svchost.exe	49
PID 1676 wrote to memory of 676	1676	svchost.exe	49
PID 1676 wrote to memory of 676	1676	svchost.exe	49
PID 1676 wrote to memory of 584	1676	svchost.exe	51
PID 1676 wrote to memory of 584	1676	svchost.exe	51
PID 1676 wrote to memory of 584	1676	svchost.exe	51
PID 1676 wrote to memory of 2144	1676	svchost.exe	53
PID 1676 wrote to memory of 2144	1676	svchost.exe	53
PID 1676 wrote to memory of 2144	1676	svchost.exe	53
PID 1676 wrote to memory of 2240	1676	svchost.exe	55
PID 1676 wrote to memory of 2240	1676	svchost.exe	55
PID 1676 wrote to memory of 2240	1676	svchost.exe	55
PID 1688 wrote to memory of 1824	1688	taskeng.exe	58
PID 1688 wrote to memory of 1824	1688	taskeng.exe	58
PID 1688 wrote to memory of 1824	1688	taskeng.exe	58
PID 1824 wrote to memory of 2696	1824	svchost.exe	59
PID 1824 wrote to memory of 2696	1824	svchost.exe	59
PID 1824 wrote to memory of 2696	1824	svchost.exe	59

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads