asyncrat | 97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe\""	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

Modify Existing Service

T1031

Disabling Security Tools

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

Modify Registry

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe = "0"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe = "0"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1276-79-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1276-80-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1276-81-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1276-82-0x000000000040C73E-mapping.dmp	asyncrat
behavioral1/memory/1276-84-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1276-86-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Drops startup file 2 IoCs

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Windows security modification 2 TTPs 9 IoCs

evasion trojan

Disabling Security Tools

Modify Registry

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe = "0"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe = "0"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe"	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

pid	process
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

description	pid	process	target process
PID 1752 set thread context of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1616 1752 WerFault.exe 97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

976 timeout.exe

pid	pid_target	process	target process
1616	1752	WerFault.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

pid	process
976	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

pid	process
520	powershell.exe
1708	powershell.exe
1972	powershell.exe
1380	powershell.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exe97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
Token: SeDebugPrivilege	1380	powershell.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.execmd.exe

description	pid	process	target process
PID 1752 wrote to memory of 520	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 520	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 520	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 520	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1708	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1708	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1708	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1708	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1972	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1972	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1972	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1972	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1380	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1380	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1380	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 1380	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	powershell.exe
PID 1752 wrote to memory of 432	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	cmd.exe
PID 1752 wrote to memory of 432	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	cmd.exe
PID 1752 wrote to memory of 432	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	cmd.exe
PID 1752 wrote to memory of 432	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	cmd.exe
PID 432 wrote to memory of 976	432	cmd.exe	timeout.exe
PID 432 wrote to memory of 976	432	cmd.exe	timeout.exe
PID 432 wrote to memory of 976	432	cmd.exe	timeout.exe
PID 432 wrote to memory of 976	432	cmd.exe	timeout.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1276	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
PID 1752 wrote to memory of 1616	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	WerFault.exe
PID 1752 wrote to memory of 1616	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	WerFault.exe
PID 1752 wrote to memory of 1616	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	WerFault.exe
PID 1752 wrote to memory of 1616	1752	97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
"C:\Users\Admin\AppData\Local\Temp\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:976

C:\Users\Admin\AppData\Local\Temp\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe
"C:\Users\Admin\AppData\Local\Temp\97de910f99c0d563605040f89beb13ca559618e7a3572d57ec430cdc861761c3.exe"
2⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 1912
2⤵
- Program crash
PID:1616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

6

Disabling Security Tools

3

Install Root Certificate

T1130

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service