8fdae5b4490183c9057a684f0ac2f82dd5c8911cb2f43a54ff47a9ad6e93952a

Analysis

max time kernel
150s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Discord-RAT-2.0-master/Discord rat/Resources/rootkit.exe
Size 223KB
Sample260508-pcnb9abx2n
SHA256 8fdae5b4490183c9057a684f0ac2f82dd5c8911cb2f43a54ff47a9ad6e93952a
MD5 d72fea64a05b3f7dce725352d7c1d032
SHA1 9c27e234567d237d9c495353567f2efa42e8f616
SHA512 56bb1c4d83587ecc5f8bb41882d449e1812cdf1db1fee4068f5ef1b49f28d3e0af95e14f306d494a6c6cd4771c052360a96388f59bfa409affb3b21790da00d3
SSDEEP 6144:wguKV5BwUnZqazMhD9RLJt88sndcP8pPyDvUGOks:kKLBwiZlzMB9xgndcP88DvvP
TLSH
T11024129B22DCE679C47F4F3EAEA8524197B7A0C68A474B20419CC5B51F3EEB409125CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 696 created 636	696	rootkit.exe	5

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 420	696	rootkit.exe	79

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={2ADA3869-6833-4E23-B72E-62C6DD9F1F6D}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1778242390"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 08 May 2026 12:13:11 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
696	rootkit.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe
420	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3124	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	696	rootkit.exe
Token: SeDebugPrivilege	696	rootkit.exe
Token: SeDebugPrivilege	420	dllhost.exe
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	460	dwm.exe
Token: SeCreatePagefilePrivilege	460	dwm.exe
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3124	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 696 wrote to memory of 420	696	rootkit.exe	79
PID 420 wrote to memory of 636	420	dllhost.exe	5
PID 420 wrote to memory of 688	420	dllhost.exe	7
PID 420 wrote to memory of 896	420	dllhost.exe	11
PID 420 wrote to memory of 404	420	dllhost.exe	13
PID 420 wrote to memory of 460	420	dllhost.exe	14
PID 420 wrote to memory of 1052	420	dllhost.exe	15
PID 420 wrote to memory of 1088	420	dllhost.exe	17
PID 420 wrote to memory of 1208	420	dllhost.exe	18
PID 420 wrote to memory of 1216	420	dllhost.exe	19
PID 420 wrote to memory of 1224	420	dllhost.exe	20
PID 420 wrote to memory of 1260	420	dllhost.exe	21
PID 420 wrote to memory of 1324	420	dllhost.exe	22
PID 420 wrote to memory of 1368	420	dllhost.exe	23
PID 420 wrote to memory of 1380	420	dllhost.exe	24
PID 420 wrote to memory of 1420	420	dllhost.exe	25
PID 420 wrote to memory of 1492	420	dllhost.exe	26
PID 420 wrote to memory of 1748	420	dllhost.exe	27
PID 420 wrote to memory of 1792	420	dllhost.exe	28
PID 420 wrote to memory of 1800	420	dllhost.exe	29
PID 420 wrote to memory of 1840	420	dllhost.exe	30
PID 420 wrote to memory of 1892	420	dllhost.exe	31
PID 420 wrote to memory of 1928	420	dllhost.exe	32
PID 420 wrote to memory of 1992	420	dllhost.exe	33
PID 420 wrote to memory of 2036	420	dllhost.exe	34
PID 420 wrote to memory of 2060	420	dllhost.exe	35
PID 420 wrote to memory of 2068	420	dllhost.exe	36
PID 420 wrote to memory of 2084	420	dllhost.exe	37
PID 420 wrote to memory of 2124	420	dllhost.exe	38
PID 420 wrote to memory of 2180	420	dllhost.exe	39
PID 420 wrote to memory of 2316	420	dllhost.exe	41
PID 420 wrote to memory of 2572	420	dllhost.exe	42
PID 420 wrote to memory of 2580	420	dllhost.exe	43
PID 420 wrote to memory of 2592	420	dllhost.exe	44
PID 420 wrote to memory of 2660	420	dllhost.exe	45
PID 420 wrote to memory of 2684	420	dllhost.exe	46
PID 420 wrote to memory of 2740	420	dllhost.exe	48
PID 420 wrote to memory of 2748	420	dllhost.exe	49
PID 420 wrote to memory of 2756	420	dllhost.exe	50
PID 420 wrote to memory of 2832	420	dllhost.exe	51
PID 420 wrote to memory of 1084	420	dllhost.exe	52
PID 420 wrote to memory of 3124	420	dllhost.exe	53
PID 420 wrote to memory of 3252	420	dllhost.exe	54
PID 420 wrote to memory of 3320	420	dllhost.exe	55
PID 420 wrote to memory of 3636	420	dllhost.exe	58
PID 420 wrote to memory of 3680	420	dllhost.exe	59
PID 420 wrote to memory of 3784	420	dllhost.exe	60
PID 420 wrote to memory of 3808	420	dllhost.exe	61
PID 420 wrote to memory of 4108	420	dllhost.exe	62
PID 420 wrote to memory of 4208	420	dllhost.exe	63
PID 420 wrote to memory of 1296	420	dllhost.exe	67
PID 420 wrote to memory of 1676	420	dllhost.exe	68
PID 420 wrote to memory of 5040	420	dllhost.exe	70
PID 420 wrote to memory of 1104	420	dllhost.exe	71
PID 420 wrote to memory of 2852	420	dllhost.exe	72
PID 420 wrote to memory of 1480	420	dllhost.exe	73

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:460
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c934a5da-712c-493f-8392-b62b12522e56}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:420

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-48c977e7-76a6-48ea-b785-e5f037f558f9 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bef58f2d-9fdc-40f3-8d19-23e040a360f4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-560be08a-dda4-405a-a85b-1c90e5f871f4 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-91897ed8-3e65-4c27-8531-b5b3f6ef95ea -LifetimeId:1a106720-5301-423e-80d2-be05dda697ce -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1492
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2124

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1084

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3124
- C:\Users\Admin\AppData\Local\Temp\Discord-RAT-2.0-master\Discord rat\Resources\rootkit.exe
  "C:\Users\Admin\AppData\Local\Temp\Discord-RAT-2.0-master\Discord rat\Resources\rootkit.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3320

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3636

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3808

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:5040

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2852

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/404-34-0x00000147EEEF0000-0x00000147EEF1A000-memory.dmp

Download

memory/404-39-0x00000147EEEF0000-0x00000147EEF1A000-memory.dmp

Download

memory/404-169-0x00000147EEEF0000-0x00000147EEF1A000-memory.dmp

Download

memory/404-35-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/420-9-0x00007FFC45A80000-0x00007FFC45B3D000-memory.dmp

Download

memory/420-5-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/420-12-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/420-6-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/420-8-0x00007FFC46040000-0x00007FFC46249000-memory.dmp

Download

memory/420-4-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/460-37-0x0000022C2FE70000-0x0000022C2FE9A000-memory.dmp

Download

memory/460-28-0x0000022C2FE70000-0x0000022C2FE9A000-memory.dmp

Download

memory/460-29-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/636-16-0x000001756E630000-0x000001756E65A000-memory.dmp

Download

memory/636-17-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/636-15-0x000001756E600000-0x000001756E623000-memory.dmp

Download

memory/636-23-0x000001756E630000-0x000001756E65A000-memory.dmp

Download

memory/688-20-0x000001D06ABB0000-0x000001D06ABDA000-memory.dmp

Download

memory/688-24-0x000001D06ABB0000-0x000001D06ABDA000-memory.dmp

Download

memory/688-21-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/696-11-0x00007FFC269E0000-0x00007FFC27381000-memory.dmp

Download

memory/696-3-0x00007FFC45A80000-0x00007FFC45B3D000-memory.dmp

Download

memory/696-1-0x00007FFC269E0000-0x00007FFC27381000-memory.dmp

Download

memory/696-2-0x00007FFC46040000-0x00007FFC46249000-memory.dmp

Download

memory/696-10-0x00007FFC269E0000-0x00007FFC27381000-memory.dmp

Download

memory/696-0-0x00007FFC26C95000-0x00007FFC26C96000-memory.dmp

Download

memory/896-38-0x000001784F440000-0x000001784F46A000-memory.dmp

Download

memory/896-168-0x000001784F440000-0x000001784F46A000-memory.dmp

Download

memory/896-31-0x000001784F440000-0x000001784F46A000-memory.dmp

Download

memory/896-32-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1052-44-0x00000213EA370000-0x00000213EA39A000-memory.dmp

Download

memory/1052-42-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1052-41-0x00000213EA370000-0x00000213EA39A000-memory.dmp

Download

memory/1052-274-0x00000213EA370000-0x00000213EA39A000-memory.dmp

Download

memory/1088-52-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1088-69-0x00000264057D0000-0x00000264057FA000-memory.dmp

Download

memory/1088-275-0x00000264057D0000-0x00000264057FA000-memory.dmp

Download

memory/1088-51-0x00000264057D0000-0x00000264057FA000-memory.dmp

Download

memory/1208-54-0x0000023911690000-0x00000239116BA000-memory.dmp

Download

memory/1208-276-0x0000023911690000-0x00000239116BA000-memory.dmp

Download

memory/1208-70-0x0000023911690000-0x00000239116BA000-memory.dmp

Download

memory/1208-55-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1216-57-0x000001BEA9900000-0x000001BEA992A000-memory.dmp

Download

memory/1216-71-0x000001BEA9900000-0x000001BEA992A000-memory.dmp

Download

memory/1216-277-0x000001BEA9900000-0x000001BEA992A000-memory.dmp

Download

memory/1216-58-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1224-278-0x000001850BA90000-0x000001850BABA000-memory.dmp

Download

memory/1224-60-0x000001850BA90000-0x000001850BABA000-memory.dmp

Download

memory/1224-61-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1224-72-0x000001850BA90000-0x000001850BABA000-memory.dmp

Download

memory/1260-64-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1260-279-0x000001D46BF90000-0x000001D46BFBA000-memory.dmp

Download

memory/1260-73-0x000001D46BF90000-0x000001D46BFBA000-memory.dmp

Download

memory/1260-63-0x000001D46BF90000-0x000001D46BFBA000-memory.dmp

Download

memory/1324-67-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1324-280-0x00000224BF860000-0x00000224BF88A000-memory.dmp

Download

memory/1324-66-0x00000224BF860000-0x00000224BF88A000-memory.dmp

Download

memory/1324-74-0x00000224BF860000-0x00000224BF88A000-memory.dmp

Download

memory/1368-78-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1368-282-0x00000276F9E90000-0x00000276F9EBA000-memory.dmp

Download

memory/1368-83-0x00000276F9E90000-0x00000276F9EBA000-memory.dmp

Download

memory/1368-77-0x00000276F9E90000-0x00000276F9EBA000-memory.dmp

Download

memory/1380-80-0x0000011AE9390000-0x0000011AE93BA000-memory.dmp

Download

memory/1380-84-0x0000011AE9390000-0x0000011AE93BA000-memory.dmp

Download

memory/1380-81-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1380-283-0x0000011AE9390000-0x0000011AE93BA000-memory.dmp

Download

memory/1420-92-0x0000022744330000-0x000002274435A000-memory.dmp

Download

memory/1420-93-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1420-113-0x0000022744330000-0x000002274435A000-memory.dmp

Download

memory/1420-284-0x0000022744330000-0x000002274435A000-memory.dmp

Download

memory/1492-285-0x0000017E3AC00000-0x0000017E3AC2A000-memory.dmp

Download

memory/1492-114-0x0000017E3AC00000-0x0000017E3AC2A000-memory.dmp

Download

memory/1492-96-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1492-95-0x0000017E3AC00000-0x0000017E3AC2A000-memory.dmp

Download

memory/1748-286-0x000002652FAF0000-0x000002652FB1A000-memory.dmp

Download

memory/1748-99-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1748-115-0x000002652FAF0000-0x000002652FB1A000-memory.dmp

Download

memory/1748-98-0x000002652FAF0000-0x000002652FB1A000-memory.dmp

Download

memory/1792-116-0x00000236998E0000-0x000002369990A000-memory.dmp

Download

memory/1792-102-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1792-287-0x00000236998E0000-0x000002369990A000-memory.dmp

Download

memory/1792-101-0x00000236998E0000-0x000002369990A000-memory.dmp

Download

memory/1800-117-0x0000021585580000-0x00000215855AA000-memory.dmp

Download

memory/1800-105-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1800-104-0x0000021585580000-0x00000215855AA000-memory.dmp

Download

memory/1800-288-0x0000021585580000-0x00000215855AA000-memory.dmp

Download

memory/1840-108-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1840-107-0x000001C165A60000-0x000001C165A8A000-memory.dmp

Download

memory/1840-118-0x000001C165A60000-0x000001C165A8A000-memory.dmp

Download

memory/1840-289-0x000001C165A60000-0x000001C165A8A000-memory.dmp

Download

memory/1892-110-0x00000205EF890000-0x00000205EF8BA000-memory.dmp

Download

memory/1892-290-0x00000205EF890000-0x00000205EF8BA000-memory.dmp

Download

memory/1892-111-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1892-119-0x00000205EF890000-0x00000205EF8BA000-memory.dmp

Download

memory/1928-170-0x00000210144C0000-0x00000210144EA000-memory.dmp

Download

memory/1928-291-0x00000210144C0000-0x00000210144EA000-memory.dmp

Download

memory/1928-132-0x00000210144C0000-0x00000210144EA000-memory.dmp

Download

memory/1928-133-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/1992-292-0x0000029250FC0000-0x0000029250FEA000-memory.dmp

Download

memory/1992-171-0x0000029250FC0000-0x0000029250FEA000-memory.dmp

Download

memory/1992-135-0x0000029250FC0000-0x0000029250FEA000-memory.dmp

Download

memory/1992-136-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/2036-139-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/2036-138-0x000001F14D760000-0x000001F14D78A000-memory.dmp

Download

memory/2060-141-0x00000225A6A60000-0x00000225A6A8A000-memory.dmp

Download

memory/2060-142-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/2068-144-0x000001BC59BD0000-0x000001BC59BFA000-memory.dmp

Download

memory/2068-145-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/2084-147-0x00000237913A0000-0x00000237913CA000-memory.dmp

Download

memory/2084-148-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download

memory/2124-150-0x000001E719E90000-0x000001E719EBA000-memory.dmp

Download

memory/2124-151-0x00007FFC060D0000-0x00007FFC060E0000-memory.dmp

Download