pid	process
1712	svchost_dump_SCY - Copy.exe
1712	svchost_dump_SCY - Copy.exe

description	ioc	process
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

pid	process
2420	powershell.exe
2596	powershell.exe
1712	svchost_dump_SCY - Copy.exe
2364	powershell.exe
1148	powershell.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2688	WMIC.exe
Token: SeSecurityPrivilege	2688	WMIC.exe
Token: SeTakeOwnershipPrivilege	2688	WMIC.exe
Token: SeLoadDriverPrivilege	2688	WMIC.exe
Token: SeSystemProfilePrivilege	2688	WMIC.exe
Token: SeSystemtimePrivilege	2688	WMIC.exe
Token: SeProfSingleProcessPrivilege	2688	WMIC.exe
Token: SeIncBasePriorityPrivilege	2688	WMIC.exe
Token: SeCreatePagefilePrivilege	2688	WMIC.exe
Token: SeBackupPrivilege	2688	WMIC.exe
Token: SeRestorePrivilege	2688	WMIC.exe
Token: SeShutdownPrivilege	2688	WMIC.exe
Token: SeDebugPrivilege	2688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2688	WMIC.exe
Token: SeRemoteShutdownPrivilege	2688	WMIC.exe
Token: SeUndockPrivilege	2688	WMIC.exe
Token: SeManageVolumePrivilege	2688	WMIC.exe
Token: 33	2688	WMIC.exe
Token: 34	2688	WMIC.exe
Token: 35	2688	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2688	WMIC.exe
Token: SeSecurityPrivilege	2688	WMIC.exe
Token: SeTakeOwnershipPrivilege	2688	WMIC.exe
Token: SeLoadDriverPrivilege	2688	WMIC.exe
Token: SeSystemProfilePrivilege	2688	WMIC.exe
Token: SeSystemtimePrivilege	2688	WMIC.exe
Token: SeProfSingleProcessPrivilege	2688	WMIC.exe
Token: SeIncBasePriorityPrivilege	2688	WMIC.exe
Token: SeCreatePagefilePrivilege	2688	WMIC.exe
Token: SeBackupPrivilege	2688	WMIC.exe
Token: SeRestorePrivilege	2688	WMIC.exe
Token: SeShutdownPrivilege	2688	WMIC.exe
Token: SeDebugPrivilege	2688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2688	WMIC.exe
Token: SeRemoteShutdownPrivilege	2688	WMIC.exe
Token: SeUndockPrivilege	2688	WMIC.exe
Token: SeManageVolumePrivilege	2688	WMIC.exe
Token: 33	2688	WMIC.exe
Token: 34	2688	WMIC.exe
Token: 35	2688	WMIC.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeIncreaseQuotaPrivilege	1660	WMIC.exe
Token: SeSecurityPrivilege	1660	WMIC.exe
Token: SeTakeOwnershipPrivilege	1660	WMIC.exe
Token: SeLoadDriverPrivilege	1660	WMIC.exe
Token: SeSystemProfilePrivilege	1660	WMIC.exe
Token: SeSystemtimePrivilege	1660	WMIC.exe
Token: SeProfSingleProcessPrivilege	1660	WMIC.exe
Token: SeIncBasePriorityPrivilege	1660	WMIC.exe
Token: SeCreatePagefilePrivilege	1660	WMIC.exe
Token: SeBackupPrivilege	1660	WMIC.exe
Token: SeRestorePrivilege	1660	WMIC.exe
Token: SeShutdownPrivilege	1660	WMIC.exe
Token: SeDebugPrivilege	1660	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1660	WMIC.exe
Token: SeRemoteShutdownPrivilege	1660	WMIC.exe
Token: SeUndockPrivilege	1660	WMIC.exe
Token: SeManageVolumePrivilege	1660	WMIC.exe
Token: 33	1660	WMIC.exe
Token: 34	1660	WMIC.exe
Token: 35	1660	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1660	WMIC.exe
Token: SeSecurityPrivilege	1660	WMIC.exe

description	pid	process	target process
PID 1712 wrote to memory of 2688	1712	svchost_dump_SCY - Copy.exe	WMIC.exe
PID 1712 wrote to memory of 2688	1712	svchost_dump_SCY - Copy.exe	WMIC.exe
PID 1712 wrote to memory of 2688	1712	svchost_dump_SCY - Copy.exe	WMIC.exe
PID 1712 wrote to memory of 2680	1712	svchost_dump_SCY - Copy.exe	netsh.exe
PID 1712 wrote to memory of 2680	1712	svchost_dump_SCY - Copy.exe	netsh.exe
PID 1712 wrote to memory of 2680	1712	svchost_dump_SCY - Copy.exe	netsh.exe
PID 1712 wrote to memory of 2664	1712	svchost_dump_SCY - Copy.exe	netsh.exe
PID 1712 wrote to memory of 2664	1712	svchost_dump_SCY - Copy.exe	netsh.exe
PID 1712 wrote to memory of 2664	1712	svchost_dump_SCY - Copy.exe	netsh.exe
PID 1712 wrote to memory of 2596	1712	svchost_dump_SCY - Copy.exe	powershell.exe
PID 1712 wrote to memory of 2596	1712	svchost_dump_SCY - Copy.exe	powershell.exe
PID 1712 wrote to memory of 2596	1712	svchost_dump_SCY - Copy.exe	powershell.exe
PID 1712 wrote to memory of 2420	1712	svchost_dump_SCY - Copy.exe	powershell.exe
PID 1712 wrote to memory of 2420	1712	svchost_dump_SCY - Copy.exe	powershell.exe
PID 1712 wrote to memory of 2420	1712	svchost_dump_SCY - Copy.exe	powershell.exe
PID 1712 wrote to memory of 2012	1712	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 1712 wrote to memory of 2012	1712	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 1712 wrote to memory of 2012	1712	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 1712 wrote to memory of 1296	1712	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 1712 wrote to memory of 1296	1712	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 1712 wrote to memory of 1296	1712	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 1712 wrote to memory of 1032	1712	svchost_dump_SCY - Copy.exe	svchost.exe
PID 1712 wrote to memory of 1032	1712	svchost_dump_SCY - Copy.exe	svchost.exe
PID 1712 wrote to memory of 1032	1712	svchost_dump_SCY - Copy.exe	svchost.exe
PID 1032 wrote to memory of 1660	1032	svchost.exe	WMIC.exe
PID 1032 wrote to memory of 1660	1032	svchost.exe	WMIC.exe
PID 1032 wrote to memory of 1660	1032	svchost.exe	WMIC.exe
PID 1032 wrote to memory of 2336	1032	svchost.exe	netsh.exe
PID 1032 wrote to memory of 2336	1032	svchost.exe	netsh.exe
PID 1032 wrote to memory of 2336	1032	svchost.exe	netsh.exe
PID 1032 wrote to memory of 3044	1032	svchost.exe	netsh.exe
PID 1032 wrote to memory of 3044	1032	svchost.exe	netsh.exe
PID 1032 wrote to memory of 3044	1032	svchost.exe	netsh.exe
PID 1032 wrote to memory of 2364	1032	svchost.exe	powershell.exe
PID 1032 wrote to memory of 2364	1032	svchost.exe	powershell.exe
PID 1032 wrote to memory of 2364	1032	svchost.exe	powershell.exe
PID 1032 wrote to memory of 1148	1032	svchost.exe	powershell.exe
PID 1032 wrote to memory of 1148	1032	svchost.exe	powershell.exe
PID 1032 wrote to memory of 1148	1032	svchost.exe	powershell.exe

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads