pid	Process
2328	svchost_dump_SCY - Copy.exe
2328	svchost_dump_SCY - Copy.exe

description	ioc	Process
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe

pid	Process
2260	powershell.exe
2596	powershell.exe
2328	svchost_dump_SCY - Copy.exe
2008	powershell.exe
1836	powershell.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2944	WMIC.exe
Token: SeSecurityPrivilege	2944	WMIC.exe
Token: SeTakeOwnershipPrivilege	2944	WMIC.exe
Token: SeLoadDriverPrivilege	2944	WMIC.exe
Token: SeSystemProfilePrivilege	2944	WMIC.exe
Token: SeSystemtimePrivilege	2944	WMIC.exe
Token: SeProfSingleProcessPrivilege	2944	WMIC.exe
Token: SeIncBasePriorityPrivilege	2944	WMIC.exe
Token: SeCreatePagefilePrivilege	2944	WMIC.exe
Token: SeBackupPrivilege	2944	WMIC.exe
Token: SeRestorePrivilege	2944	WMIC.exe
Token: SeShutdownPrivilege	2944	WMIC.exe
Token: SeDebugPrivilege	2944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2944	WMIC.exe
Token: SeRemoteShutdownPrivilege	2944	WMIC.exe
Token: SeUndockPrivilege	2944	WMIC.exe
Token: SeManageVolumePrivilege	2944	WMIC.exe
Token: 33	2944	WMIC.exe
Token: 34	2944	WMIC.exe
Token: 35	2944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2944	WMIC.exe
Token: SeSecurityPrivilege	2944	WMIC.exe
Token: SeTakeOwnershipPrivilege	2944	WMIC.exe
Token: SeLoadDriverPrivilege	2944	WMIC.exe
Token: SeSystemProfilePrivilege	2944	WMIC.exe
Token: SeSystemtimePrivilege	2944	WMIC.exe
Token: SeProfSingleProcessPrivilege	2944	WMIC.exe
Token: SeIncBasePriorityPrivilege	2944	WMIC.exe
Token: SeCreatePagefilePrivilege	2944	WMIC.exe
Token: SeBackupPrivilege	2944	WMIC.exe
Token: SeRestorePrivilege	2944	WMIC.exe
Token: SeShutdownPrivilege	2944	WMIC.exe
Token: SeDebugPrivilege	2944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2944	WMIC.exe
Token: SeRemoteShutdownPrivilege	2944	WMIC.exe
Token: SeUndockPrivilege	2944	WMIC.exe
Token: SeManageVolumePrivilege	2944	WMIC.exe
Token: 33	2944	WMIC.exe
Token: 34	2944	WMIC.exe
Token: 35	2944	WMIC.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeIncreaseQuotaPrivilege	1448	WMIC.exe
Token: SeSecurityPrivilege	1448	WMIC.exe
Token: SeTakeOwnershipPrivilege	1448	WMIC.exe
Token: SeLoadDriverPrivilege	1448	WMIC.exe
Token: SeSystemProfilePrivilege	1448	WMIC.exe
Token: SeSystemtimePrivilege	1448	WMIC.exe
Token: SeProfSingleProcessPrivilege	1448	WMIC.exe
Token: SeIncBasePriorityPrivilege	1448	WMIC.exe
Token: SeCreatePagefilePrivilege	1448	WMIC.exe
Token: SeBackupPrivilege	1448	WMIC.exe
Token: SeRestorePrivilege	1448	WMIC.exe
Token: SeShutdownPrivilege	1448	WMIC.exe
Token: SeDebugPrivilege	1448	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1448	WMIC.exe
Token: SeRemoteShutdownPrivilege	1448	WMIC.exe
Token: SeUndockPrivilege	1448	WMIC.exe
Token: SeManageVolumePrivilege	1448	WMIC.exe
Token: 33	1448	WMIC.exe
Token: 34	1448	WMIC.exe
Token: 35	1448	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1448	WMIC.exe
Token: SeSecurityPrivilege	1448	WMIC.exe

description	pid	Process	procid_target
PID 2328 wrote to memory of 2944	2328	svchost_dump_SCY - Copy.exe	29
PID 2328 wrote to memory of 2944	2328	svchost_dump_SCY - Copy.exe	29
PID 2328 wrote to memory of 2944	2328	svchost_dump_SCY - Copy.exe	29
PID 2328 wrote to memory of 2800	2328	svchost_dump_SCY - Copy.exe	31
PID 2328 wrote to memory of 2800	2328	svchost_dump_SCY - Copy.exe	31
PID 2328 wrote to memory of 2800	2328	svchost_dump_SCY - Copy.exe	31
PID 2328 wrote to memory of 2692	2328	svchost_dump_SCY - Copy.exe	33
PID 2328 wrote to memory of 2692	2328	svchost_dump_SCY - Copy.exe	33
PID 2328 wrote to memory of 2692	2328	svchost_dump_SCY - Copy.exe	33
PID 2328 wrote to memory of 2260	2328	svchost_dump_SCY - Copy.exe	35
PID 2328 wrote to memory of 2260	2328	svchost_dump_SCY - Copy.exe	35
PID 2328 wrote to memory of 2260	2328	svchost_dump_SCY - Copy.exe	35
PID 2328 wrote to memory of 2596	2328	svchost_dump_SCY - Copy.exe	37
PID 2328 wrote to memory of 2596	2328	svchost_dump_SCY - Copy.exe	37
PID 2328 wrote to memory of 2596	2328	svchost_dump_SCY - Copy.exe	37
PID 2328 wrote to memory of 924	2328	svchost_dump_SCY - Copy.exe	39
PID 2328 wrote to memory of 924	2328	svchost_dump_SCY - Copy.exe	39
PID 2328 wrote to memory of 924	2328	svchost_dump_SCY - Copy.exe	39
PID 2328 wrote to memory of 2308	2328	svchost_dump_SCY - Copy.exe	41
PID 2328 wrote to memory of 2308	2328	svchost_dump_SCY - Copy.exe	41
PID 2328 wrote to memory of 2308	2328	svchost_dump_SCY - Copy.exe	41
PID 2328 wrote to memory of 944	2328	svchost_dump_SCY - Copy.exe	43
PID 2328 wrote to memory of 944	2328	svchost_dump_SCY - Copy.exe	43
PID 2328 wrote to memory of 944	2328	svchost_dump_SCY - Copy.exe	43
PID 944 wrote to memory of 1448	944	svchost.exe	45
PID 944 wrote to memory of 1448	944	svchost.exe	45
PID 944 wrote to memory of 1448	944	svchost.exe	45
PID 944 wrote to memory of 1084	944	svchost.exe	47
PID 944 wrote to memory of 1084	944	svchost.exe	47
PID 944 wrote to memory of 1084	944	svchost.exe	47
PID 944 wrote to memory of 2360	944	svchost.exe	49
PID 944 wrote to memory of 2360	944	svchost.exe	49
PID 944 wrote to memory of 2360	944	svchost.exe	49
PID 944 wrote to memory of 2008	944	svchost.exe	51
PID 944 wrote to memory of 2008	944	svchost.exe	51
PID 944 wrote to memory of 2008	944	svchost.exe	51
PID 944 wrote to memory of 1836	944	svchost.exe	53
PID 944 wrote to memory of 1836	944	svchost.exe	53
PID 944 wrote to memory of 1836	944	svchost.exe	53

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads