description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	4132	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	4132	schtasks.exe	77

resource	yara_rule
behavioral3/memory/1812-1-0x00000000009C0000-0x0000000000A96000-memory.dmp	dcrat
behavioral3/files/0x001900000002abff-11.dat	dcrat

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\csrss.exe	WebReview.exe
File created	C:\Program Files (x86)\Windows Mail\886983d96e3d3e	WebReview.exe
File created	C:\Program Files (x86)\Windows Mail\fontdrvhost.exe	WebReview.exe
File created	C:\Program Files (x86)\Windows Mail\5b884080fd4f94	WebReview.exe
File created	C:\Program Files (x86)\Windows Mail\csrss.exe	WebReview.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\smss.exe	WebReview.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\69ddcba757bf72	WebReview.exe
File created	C:\Program Files\VideoLAN\dllhost.exe	WebReview.exe
File created	C:\Program Files\VideoLAN\5940a34987c991	WebReview.exe

description	ioc	Process
File created	C:\Windows\Media\Festival\29c1c3cc0f7685	WebReview.exe
File created	C:\Windows\assembly\temp\Registry.exe	WebReview.exe
File created	C:\Windows\Help\en-US\csrss.exe	WebReview.exe
File created	C:\Windows\ServiceState\EventLog\Data\spoolsv.exe	WebReview.exe
File created	C:\Windows\Media\Festival\unsecapp.exe	WebReview.exe
File created	C:\Windows\assembly\temp\ee2ad38f3d4382	WebReview.exe
File created	C:\Windows\Panther\UnattendGC\fontdrvhost.exe	WebReview.exe
File created	C:\Windows\Panther\UnattendGC\5b884080fd4f94	WebReview.exe
File created	C:\Windows\Help\en-US\886983d96e3d3e	WebReview.exe

pid	Process
1812	WebReview.exe
1812	WebReview.exe
1812	WebReview.exe
1812	WebReview.exe
1812	WebReview.exe
1812	WebReview.exe
1812	WebReview.exe
1812	WebReview.exe
1812	WebReview.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe

description	pid	Process
Token: SeDebugPrivilege	1812	WebReview.exe
Token: SeDebugPrivilege	2968	services.exe

description	pid	Process	procid_target
PID 1812 wrote to memory of 5104	1812	WebReview.exe	120
PID 1812 wrote to memory of 5104	1812	WebReview.exe	120
PID 5104 wrote to memory of 2168	5104	cmd.exe	122
PID 5104 wrote to memory of 2168	5104	cmd.exe	122
PID 5104 wrote to memory of 2968	5104	cmd.exe	123
PID 5104 wrote to memory of 2968	5104	cmd.exe	123

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads