description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	1964	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	1964	schtasks.exe	31

resource	yara_rule
behavioral1/memory/2060-1-0x0000000000EC0000-0x0000000000F96000-memory.dmp	dcrat
behavioral1/files/0x0005000000019397-11.dat	dcrat
behavioral1/memory/2084-35-0x00000000003F0000-0x00000000004C6000-memory.dmp	dcrat

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\dllhost.exe	WebReview.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\5940a34987c991	WebReview.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe	WebReview.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\0a1fd5f707cd16	WebReview.exe
File created	C:\Program Files\Microsoft Games\smss.exe	WebReview.exe
File created	C:\Program Files\Microsoft Games\69ddcba757bf72	WebReview.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\audiodg.exe	WebReview.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\42af1c969fbb7b	WebReview.exe

description	ioc	Process
File created	C:\Windows\twain_32\explorer.exe	WebReview.exe
File created	C:\Windows\twain_32\7a0fd90576e088	WebReview.exe
File created	C:\Windows\servicing\Editions\dllhost.exe	WebReview.exe
File created	C:\Windows\servicing\Editions\5940a34987c991	WebReview.exe
File created	C:\Windows\Vss\Writers\System\winlogon.exe	WebReview.exe
File created	C:\Windows\Vss\Writers\System\cc11b995f2a76d	WebReview.exe

pid	Process
2060	WebReview.exe
2060	WebReview.exe
2060	WebReview.exe
2084	winlogon.exe
2084	winlogon.exe
2084	winlogon.exe
2084	winlogon.exe
2084	winlogon.exe
2084	winlogon.exe
2084	winlogon.exe
2084	winlogon.exe
2084	winlogon.exe

description	pid	Process
Token: SeDebugPrivilege	2060	WebReview.exe
Token: SeDebugPrivilege	2084	winlogon.exe

description	pid	Process	procid_target
PID 2060 wrote to memory of 2084	2060	WebReview.exe	71
PID 2060 wrote to memory of 2084	2060	WebReview.exe	71
PID 2060 wrote to memory of 2084	2060	WebReview.exe	71

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads