c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
Size 123KB
Sample260930-m622dsscjg
SHA256 c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633
MD5 fba8b60f1b5989b4633445acb93d1646
SHA1 80d21ed40a0cd61ba97e9e90b79532f2bd96044e
SHA512 d1ac9d595b18ec4a5a3873419a1b1b812d3d64033a54001f5c13381205a0637f978df451b5bf1669894bff8d06d48c7f1562ec0b7c8c4b0988e56ad3238ff0c7
SSDEEP 3072:Qll/R1gfEzn1S3ZLYn7jPi7FYo2Cj3yuQ59:QlRRIYn7mRYo2w3yu
TLSH
T13AC36B6373E0A436E1330636AD493A3543BEFE301535CA57E3584A0A6EB50E2A63775F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1876	cleansweep.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cleansweep.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
1876	cleansweep.exe
1876	cleansweep.exe
1876	cleansweep.exe
1876	cleansweep.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
Token: SeDebugPrivilege	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
Token: SeDebugPrivilege	1876	cleansweep.exe
Token: SeDebugPrivilege	1876	cleansweep.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 5080	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	81
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5
PID 1624 wrote to memory of 744	1624	jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe	5

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:968
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:936
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4364
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4412
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4720
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
  2⤵
  PID:5144
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
  2⤵
  PID:4828
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3796
- C:\Windows\System32\smartscreen.exe
  C:\Windows\System32\smartscreen.exe -Embedding
  2⤵
  PID:5796

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:972

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f2da71fb-08f9-4f8a-a7e7-246f8183673f -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-07ffe102-463c-4190-9567-e363c82c71f1 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8ce5cd90-3482-4ace-b54e-385ff2020a08 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-460ba498-6279-4282-a832-6968c6d32e41 -LifetimeId:40cb21b5-f37e-47e4-b1ea-e98034f090c1 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2020
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1544
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe
      "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c27108801b0a41e8b4598092d34cf71a0ffb5afe2476c0ee23113514b5a29633.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\cleansweep.exe\cleansweep.exe
        
        "C:\cleansweep.exe\cleansweep.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2448
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3068

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3188

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4712

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:3764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5640

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleansweep.exe

Path C:\cleansweep.exe\cleansweep.exe
Size 101KB
SHA256 5e9e1cb4bdaeadc50f850f3c057d6220ff7e1ffacfc741b4b2a2d1536e574c21
MD5 e53224fa0f6dee0198a51bd107dcdb60
SHA1 5b74eaf3534304cd92227a3d8debb852331af3d8
SHA512 883b4edd5b8b1c8ec67aa4f8b78be86b5e3f19bed0d26a913a9adc404b7cf012628aa7deeeb3fbff7b1dcbbf670af37a90feb43f482300e025dba304864ec703
SSDEEP 1536:bfJ1gfHkzn1S3ZvjYjrB8egROjPy56AP8YtJXsKWF7Mfk8qVCQW3yuQS4n:bR1gfEzn1S3ZLYn7jPi7FYo2Cj3yuQ5
TLSH
T114A36B6773E0A43AE1320636AD893A3543BEFE3015358A47E3584E0A6E750E2973775F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.bin

Path C:\cleansweep.exe\config.bin
Size 382B
SHA256 e90bba4528805a0af2e8cb5ff7d261b2a718c97d8b96e0881268478060519aaa
MD5 4efdbffd8347f632319a8eb0724ce557
SHA1 41009ed94c12a73ba6ca89336898bd82a3feeb5e
SHA512 1e163a60ba79baed255834564f147fa771982b72afda90cf7fee125d476e907ea36c556552ef6313b708847db8168f308b7db5848e358e19ebeb3139317da1ae
TLSH
T198E0C056B635DC41DCA602B92A958FC80F449C79F3195103E8D83C95FA76D843A46D44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5080-13-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-15-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-32-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-31-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-30-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-29-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-28-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-27-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-26-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-25-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-23-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-22-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-21-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-20-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-19-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-16-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-14-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-12-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-9-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-8-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-7-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-6-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-5-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-4-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-3-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-1-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-24-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-2-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5080-2347-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2349-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2362-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2373-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2372-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2371-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2370-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2369-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2368-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2367-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2366-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2365-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2364-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2363-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2361-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2359-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2358-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2357-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2356-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2355-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2354-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2353-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2352-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2351-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2350-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2360-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2346-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2345-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download

memory/5080-2348-0x000000000ECD0000-0x000000000ED02000-memory.dmp

Download