Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 06:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
-
Size
992KB
-
MD5
245e85a3803b4a0bcd4a5b09759b8dd3
-
SHA1
6c8814a17c21f66c43be206368657cc179ee67a1
-
SHA256
e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b
-
SHA512
227e193dab3d01f0cffffeb4cb2a38ca8ea357245a5b92cb3b829beb5d8eb7376f14784014be73077ffe72603e4b0397ff9c906d475c2232eb2944965dabf1c1
-
SSDEEP
12288:lzAHg+1yahuV0voyd0gP8YtNmdDWtGnYoa3qkmO/UQ/7MVjzXmhQOE4Ro:FYghWuyvV0W3KWcnYoU3/P/gVjzWhjR
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe Token: SeAuditPrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 592 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 9 PID 2644 wrote to memory of 668 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 10 PID 2644 wrote to memory of 732 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 11 PID 2644 wrote to memory of 804 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 12 PID 2644 wrote to memory of 848 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 13 PID 2644 wrote to memory of 956 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 15 PID 2644 wrote to memory of 276 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 16 PID 2644 wrote to memory of 1140 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 20 PID 2644 wrote to memory of 328 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 26 PID 2644 wrote to memory of 592 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 9 PID 2644 wrote to memory of 668 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 10 PID 2644 wrote to memory of 732 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 11 PID 2644 wrote to memory of 804 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 12 PID 2644 wrote to memory of 848 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 13 PID 2644 wrote to memory of 956 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 15 PID 2644 wrote to memory of 276 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 16 PID 2644 wrote to memory of 1140 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 20 PID 2644 wrote to memory of 328 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 26 PID 2644 wrote to memory of 592 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 9 PID 2644 wrote to memory of 668 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 10 PID 2644 wrote to memory of 732 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 11 PID 2644 wrote to memory of 804 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 12 PID 2644 wrote to memory of 848 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 13 PID 2644 wrote to memory of 956 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 15 PID 2644 wrote to memory of 276 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 16 PID 2644 wrote to memory of 1140 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 20 PID 2644 wrote to memory of 328 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 26 PID 2644 wrote to memory of 592 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 9 PID 2644 wrote to memory of 668 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 10 PID 2644 wrote to memory of 732 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 11 PID 2644 wrote to memory of 804 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 12 PID 2644 wrote to memory of 848 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 13 PID 2644 wrote to memory of 956 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 15 PID 2644 wrote to memory of 276 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 16 PID 2644 wrote to memory of 1140 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 20 PID 2644 wrote to memory of 328 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 26 PID 2644 wrote to memory of 592 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 9 PID 2644 wrote to memory of 668 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 10 PID 2644 wrote to memory of 732 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 11 PID 2644 wrote to memory of 804 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 12 PID 2644 wrote to memory of 848 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 13 PID 2644 wrote to memory of 956 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 15 PID 2644 wrote to memory of 276 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 16 PID 2644 wrote to memory of 1140 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 20 PID 2644 wrote to memory of 328 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 26 PID 2644 wrote to memory of 592 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 9 PID 2644 wrote to memory of 668 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 10 PID 2644 wrote to memory of 732 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 11 PID 2644 wrote to memory of 804 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 12 PID 2644 wrote to memory of 848 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 13 PID 2644 wrote to memory of 956 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 15 PID 2644 wrote to memory of 276 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 16 PID 2644 wrote to memory of 1140 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 20 PID 2644 wrote to memory of 328 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 26 PID 2644 wrote to memory of 592 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 9 PID 2644 wrote to memory of 668 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 10 PID 2644 wrote to memory of 732 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 11 PID 2644 wrote to memory of 804 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 12 PID 2644 wrote to memory of 848 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 13 PID 2644 wrote to memory of 956 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 15 PID 2644 wrote to memory of 276 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 16 PID 2644 wrote to memory of 1140 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 20 PID 2644 wrote to memory of 328 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 26 PID 2644 wrote to memory of 592 2644 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe 9
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:592
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵PID:668
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
- Modifies security service
PID:732
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Suspicious use of AdjustPrivilegeToken
PID:848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵PID:276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe"C:\Users\Admin\AppData\Local\Temp\e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
Filesize992KB
MD5245e85a3803b4a0bcd4a5b09759b8dd3
SHA16c8814a17c21f66c43be206368657cc179ee67a1
SHA256e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b
SHA512227e193dab3d01f0cffffeb4cb2a38ca8ea357245a5b92cb3b829beb5d8eb7376f14784014be73077ffe72603e4b0397ff9c906d475c2232eb2944965dabf1c1