Overview
overview
10Static
static
100706909124...af.exe
windows7-x64
100706909124...af.exe
windows10-2004-x64
10092a8a750e...b8.exe
windows7-x64
10092a8a750e...b8.exe
windows10-2004-x64
100b4363ea1b...c7.exe
windows7-x64
100b4363ea1b...c7.exe
windows10-2004-x64
101474031cf4...a5.exe
windows7-x64
101474031cf4...a5.exe
windows10-2004-x64
101c64423afe...82.exe
windows7-x64
101c64423afe...82.exe
windows10-2004-x64
1024754063ad...fb.exe
windows7-x64
1024754063ad...fb.exe
windows10-2004-x64
10262ab91f7f...5c.exe
windows7-x64
10262ab91f7f...5c.exe
windows10-2004-x64
102c6e778930...90.exe
windows7-x64
102c6e778930...90.exe
windows10-2004-x64
10313130ecff...14.exe
windows7-x64
10313130ecff...14.exe
windows10-2004-x64
103a142d0199...a1.exe
windows7-x64
103a142d0199...a1.exe
windows10-2004-x64
10473246aff3...2b.exe
windows7-x64
10473246aff3...2b.exe
windows10-2004-x64
10532651acde...62.exe
windows7-x64
10532651acde...62.exe
windows10-2004-x64
1054d317bff9...74.exe
windows7-x64
1054d317bff9...74.exe
windows10-2004-x64
10574c22b9ce...30.exe
windows7-x64
10574c22b9ce...30.exe
windows10-2004-x64
106d76abe8ee...21.exe
windows7-x64
106d76abe8ee...21.exe
windows10-2004-x64
1076f01f1de9...6d.exe
windows7-x64
376f01f1de9...6d.exe
windows10-2004-x64
10Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-12-2024 12:11
Behavioral task
behavioral1
Sample
07069091241215607c36cbe294255edb67c26fd27ebee8923c0d0e23fc0b7baf.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
07069091241215607c36cbe294255edb67c26fd27ebee8923c0d0e23fc0b7baf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
092a8a750e5d4aee2bae9207ee5cfcaad2db4224f93cc3efe52fb113a2808db8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
0b4363ea1bbc55747d0c878125637bcf50aaeb4fc44b1b972c7b8daedc2512c7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
0b4363ea1bbc55747d0c878125637bcf50aaeb4fc44b1b972c7b8daedc2512c7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1474031cf449fb6bc31aa6bb646941714610874a7663787f62a07d817b614ea5.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
1474031cf449fb6bc31aa6bb646941714610874a7663787f62a07d817b614ea5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
1c64423afe71c8539881c789518416a72ef8ee611727513e1f47c9c9154bb782.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
1c64423afe71c8539881c789518416a72ef8ee611727513e1f47c9c9154bb782.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
24754063ad81e8ab4be77eac0a61cdf74054083d04947327adf4a062c6ef84fb.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
24754063ad81e8ab4be77eac0a61cdf74054083d04947327adf4a062c6ef84fb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
262ab91f7f3303121efe6ceec005edeabf80ebe5cfc53a807ae99b636597985c.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
262ab91f7f3303121efe6ceec005edeabf80ebe5cfc53a807ae99b636597985c.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
2c6e7789308643ecb686566eba4753a825da5dab42e11fb207f8bbfa330f3990.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
2c6e7789308643ecb686566eba4753a825da5dab42e11fb207f8bbfa330f3990.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
313130ecff1098fa44652ff626976d22f759ada06900b3e1ea125f412bf90814.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
313130ecff1098fa44652ff626976d22f759ada06900b3e1ea125f412bf90814.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
3a142d0199bd1e8504b199948f5b2742fcd704316875051f5f8cc3e75d6a1da1.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
3a142d0199bd1e8504b199948f5b2742fcd704316875051f5f8cc3e75d6a1da1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
473246aff3e141d2fc390990fa13a49cf36f66a8ace5f230250e7035981e1f2b.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
473246aff3e141d2fc390990fa13a49cf36f66a8ace5f230250e7035981e1f2b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
532651acde43a5fb82a5c4de5c3dd9ef5809e5a75d52bb9af1c672c08e8c9062.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
532651acde43a5fb82a5c4de5c3dd9ef5809e5a75d52bb9af1c672c08e8c9062.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
54d317bff9681eb1d6bfd7691dd4096dd2bc4cc3a5a02be8f80aab623f349874.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral26
Sample
54d317bff9681eb1d6bfd7691dd4096dd2bc4cc3a5a02be8f80aab623f349874.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
574c22b9ce95cd6205f7ff6bab0e414c1e0d6bc26070819ce1c1ba0ccb710930.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
574c22b9ce95cd6205f7ff6bab0e414c1e0d6bc26070819ce1c1ba0ccb710930.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
6d76abe8ee33124ffde9dae2f6bccf7836b23ab3d0a92d9458b557c362c41e21.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
6d76abe8ee33124ffde9dae2f6bccf7836b23ab3d0a92d9458b557c362c41e21.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe
-
Size
153KB
-
MD5
1d200785aaa75b290e0353e4d9866c5e
-
SHA1
206e5579975086e046dd1f2b038f8cdac1a3c120
-
SHA256
76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d
-
SHA512
2a435051e0f68293b807336a0edb1b38adb5e2d038209f9f0639052309cc4b4e022aa486700b57c845837704902e1868197ce820ee57467a14614e0bfeb108b1
-
SSDEEP
3072:5+FDrK71QkbstyJjCKICpC72s/mlaXIbqlw+UAKh/PmE:5+w713bstyJj0sC7/HEqlw+URRP
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
pid Process 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 384 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 3 PID 1964 wrote to memory of 384 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 3 PID 1964 wrote to memory of 384 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 3 PID 1964 wrote to memory of 384 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 3 PID 1964 wrote to memory of 384 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 3 PID 1964 wrote to memory of 384 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 3 PID 1964 wrote to memory of 384 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 3 PID 1964 wrote to memory of 396 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 4 PID 1964 wrote to memory of 396 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 4 PID 1964 wrote to memory of 396 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 4 PID 1964 wrote to memory of 396 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 4 PID 1964 wrote to memory of 396 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 4 PID 1964 wrote to memory of 396 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 4 PID 1964 wrote to memory of 396 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 4 PID 1964 wrote to memory of 432 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 5 PID 1964 wrote to memory of 432 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 5 PID 1964 wrote to memory of 432 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 5 PID 1964 wrote to memory of 432 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 5 PID 1964 wrote to memory of 432 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 5 PID 1964 wrote to memory of 432 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 5 PID 1964 wrote to memory of 432 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 5 PID 1964 wrote to memory of 476 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 6 PID 1964 wrote to memory of 476 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 6 PID 1964 wrote to memory of 476 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 6 PID 1964 wrote to memory of 476 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 6 PID 1964 wrote to memory of 476 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 6 PID 1964 wrote to memory of 476 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 6 PID 1964 wrote to memory of 476 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 6 PID 1964 wrote to memory of 488 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 7 PID 1964 wrote to memory of 488 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 7 PID 1964 wrote to memory of 488 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 7 PID 1964 wrote to memory of 488 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 7 PID 1964 wrote to memory of 488 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 7 PID 1964 wrote to memory of 488 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 7 PID 1964 wrote to memory of 488 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 7 PID 1964 wrote to memory of 496 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 8 PID 1964 wrote to memory of 496 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 8 PID 1964 wrote to memory of 496 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 8 PID 1964 wrote to memory of 496 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 8 PID 1964 wrote to memory of 496 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 8 PID 1964 wrote to memory of 496 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 8 PID 1964 wrote to memory of 496 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 8 PID 1964 wrote to memory of 608 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 9 PID 1964 wrote to memory of 608 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 9 PID 1964 wrote to memory of 608 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 9 PID 1964 wrote to memory of 608 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 9 PID 1964 wrote to memory of 608 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 9 PID 1964 wrote to memory of 608 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 9 PID 1964 wrote to memory of 608 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 9 PID 1964 wrote to memory of 688 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 10 PID 1964 wrote to memory of 688 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 10 PID 1964 wrote to memory of 688 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 10 PID 1964 wrote to memory of 688 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 10 PID 1964 wrote to memory of 688 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 10 PID 1964 wrote to memory of 688 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 10 PID 1964 wrote to memory of 688 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 10 PID 1964 wrote to memory of 764 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 11 PID 1964 wrote to memory of 764 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 11 PID 1964 wrote to memory of 764 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 11 PID 1964 wrote to memory of 764 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 11 PID 1964 wrote to memory of 764 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 11 PID 1964 wrote to memory of 764 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 11 PID 1964 wrote to memory of 764 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 11 PID 1964 wrote to memory of 828 1964 76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe 12
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1312
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1812
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:688
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:764
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:828
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1176
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:988
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:292
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:704
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1076
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1732
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1048
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2876
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe"C:\Users\Admin\AppData\Local\Temp\76f01f1de9ec5556d4b90155924980e6783c41dc8a2d36c653f403418343496d.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
-