dcrat | 66ac4015c48cc00c995fc8910d09e2ccc0b559785fc52a959a4d2de9fdb8c62b

Windows Service

T1543.003

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection = 22020100	svchost.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

DCRat payload 31 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe	dcrat
\Webdriversession\Intoref.exe	dcrat
behavioral1/memory/1268-107-0x0000000000A20000-0x0000000000BAC000-memory.dmp	dcrat
behavioral1/memory/2584-143-0x0000000001120000-0x00000000012AC000-memory.dmp	dcrat
behavioral1/memory/3240-2234-0x0000000000250000-0x00000000003DC000-memory.dmp	dcrat
behavioral1/memory/2488-2548-0x0000000000AC0000-0x0000000000C4C000-memory.dmp	dcrat
behavioral1/memory/596-2569-0x00000000002D0000-0x000000000045C000-memory.dmp	dcrat
behavioral1/memory/5024-2770-0x0000000001030000-0x00000000011BC000-memory.dmp	dcrat
behavioral1/memory/4984-2794-0x0000000000AD0000-0x0000000000C5C000-memory.dmp	dcrat
behavioral1/memory/5380-3405-0x00000000000D0000-0x000000000025C000-memory.dmp	dcrat
behavioral1/memory/5348-3413-0x0000000000E20000-0x0000000000FAC000-memory.dmp	dcrat
behavioral1/memory/5420-3420-0x0000000000F10000-0x000000000109C000-memory.dmp	dcrat
behavioral1/memory/5980-3878-0x0000000000AF0000-0x0000000000C7C000-memory.dmp	dcrat
behavioral1/memory/6020-3890-0x0000000000C80000-0x0000000000E0C000-memory.dmp	dcrat
behavioral1/memory/6496-4115-0x0000000001130000-0x00000000012BC000-memory.dmp	dcrat
behavioral1/memory/6708-4326-0x0000000000060000-0x00000000001EC000-memory.dmp	dcrat
behavioral1/memory/6644-4351-0x0000000001010000-0x000000000119C000-memory.dmp	dcrat
behavioral1/memory/6292-4516-0x0000000001360000-0x00000000014EC000-memory.dmp	dcrat
behavioral1/memory/7464-5192-0x0000000000E90000-0x000000000101C000-memory.dmp	dcrat
behavioral1/memory/7548-5193-0x0000000000C80000-0x0000000000E0C000-memory.dmp	dcrat
behavioral1/memory/8656-5670-0x0000000001360000-0x00000000014EC000-memory.dmp	dcrat
behavioral1/memory/8764-5672-0x0000000001020000-0x00000000011AC000-memory.dmp	dcrat
behavioral1/memory/8696-5697-0x0000000000F10000-0x000000000109C000-memory.dmp	dcrat
behavioral1/memory/8700-5889-0x00000000008A0000-0x0000000000A2C000-memory.dmp	dcrat
behavioral1/memory/8236-5911-0x0000000001010000-0x000000000119C000-memory.dmp	dcrat
behavioral1/memory/10212-6510-0x0000000000310000-0x000000000049C000-memory.dmp	dcrat
behavioral1/memory/10192-6522-0x0000000000200000-0x000000000038C000-memory.dmp	dcrat
behavioral1/memory/10428-6762-0x00000000000A0000-0x000000000022C000-memory.dmp	dcrat
behavioral1/memory/10684-7002-0x0000000000060000-0x00000000001EC000-memory.dmp	dcrat
behavioral1/memory/11304-7423-0x0000000000050000-0x00000000001DC000-memory.dmp	dcrat
behavioral1/memory/11276-7445-0x0000000001010000-0x000000000119C000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2448 powershell.exe
3480 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

pid	process
2448	powershell.exe
3480	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

services.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHRAJGDI\ImagePath = "C:\\ProgramData\\nalfdgwigwyg\\lhhsgwktkatl.exe"	services.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

Processes:

Msvchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk	Msvchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk	Msvchost.exe

Executes dropped EXE 43 IoCs

Processes:

Microsoft_Protection.exeMicrosoft_crypt.exeMicrosoft_R.exeMicrosoft_R.exeMicrosoft_M.exeMsvchost.exeMicrosoft_M.exeExplorer.EXEIntoref.execsrss.exelhhsgwktkatl.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeSystem.exeMicrosoft_WindowsDefender.exelsm.exetaskhost.execsrss.exeMicrosoft_M.exeSystem.exepowershell.exewininit.exelsm.exetaskhost.exeMicrosoft_crypt.execsrss.exeMicrosoft_M.exeSystem.exelsm.exetaskhost.exeSystem.exewininit.exepowershell.execsrss.exeMicrosoft_M.exetaskhost.exelsm.exeSystem.exeMicrosoft_crypt.execsrss.exeMicrosoft_M.exe

pid	process
2904	Microsoft_Protection.exe
2616	Microsoft_crypt.exe
2664	Microsoft_R.exe
2324	Microsoft_R.exe
2828	Microsoft_M.exe
2856	Msvchost.exe
2168	Microsoft_M.exe
1100	Explorer.EXE
1268	Intoref.exe
2584	csrss.exe
3432	lhhsgwktkatl.exe
1516	Microsoft_WindowsDefender.exe
4056	Microsoft_WindowsDefender.exe
3296	Microsoft_WindowsDefender.exe
2480	Microsoft_WindowsDefender.exe
3240	System.exe
960	Microsoft_WindowsDefender.exe
596	lsm.exe
2488	taskhost.exe
4984	csrss.exe
5024	Microsoft_M.exe
5348	System.exe
5380	powershell.exe
5420	wininit.exe
5980	lsm.exe
6020	taskhost.exe
6496	Microsoft_crypt.exe
6644	csrss.exe
6708	Microsoft_M.exe
6292	System.exe
7464	lsm.exe
7548	taskhost.exe
8656	System.exe
8696	wininit.exe
8764	powershell.exe
8236	csrss.exe
8700	Microsoft_M.exe
10212	taskhost.exe
10192	lsm.exe
10428	System.exe
10684	Microsoft_crypt.exe
11276	csrss.exe
11304	Microsoft_M.exe

Loads dropped DLL 15 IoCs

Processes:

Vape.exeMicrosoft_R.exeMicrosoft_R.exeMicrosoft_M.exeMicrosoft_M.exeExplorer.EXEcmd.exeservices.exe

pid	process
1568	Vape.exe
1568	Vape.exe
1568	Vape.exe
2664	Microsoft_R.exe
1568	Vape.exe
2324	Microsoft_R.exe
2828	Microsoft_M.exe
2168	Microsoft_M.exe
1100	Explorer.EXE
3004	cmd.exe
3004	cmd.exe
1100	Explorer.EXE
1100	Explorer.EXE
480	services.exe
480	services.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_MEI26642\python311.dll	upx
behavioral1/memory/2324-93-0x000007FEF24E0000-0x000007FEF2AC9000-memory.dmp	upx
behavioral1/memory/2168-95-0x000007FEF14D0000-0x000007FEF1AB9000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

Msvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft_WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft_WindowsDefender.exe"	Msvchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 pastebin.com
5 pastebin.com
16 pastebin.com

flow	ioc
4	pastebin.com
5	pastebin.com
16	pastebin.com

Drops file in System32 directory 22 IoCs

Processes:

WMIADAP.EXEpowershell.exesvchost.exeMicrosoft_crypt.exelhhsgwktkatl.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\system32\MRT.exe	Microsoft_crypt.exe
File opened for modification	C:\Windows\system32\MRT.exe	lhhsgwktkatl.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	svchost.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Microsoft_crypt.exelhhsgwktkatl.exe

description	pid	process	target process
PID 2616 set thread context of 1684	2616	Microsoft_crypt.exe	dialer.exe
PID 3432 set thread context of 3708	3432	lhhsgwktkatl.exe	dialer.exe
PID 3432 set thread context of 3760	3432	lhhsgwktkatl.exe	dialer.exe
PID 3432 set thread context of 3836	3432	lhhsgwktkatl.exe	dialer.exe

Drops file in Program Files directory 9 IoCs

Processes:

Intoref.exe

description	ioc	process
File created	C:\Program Files\Uninstall Information\886983d96e3d3e	Intoref.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\powershell.exe	Intoref.exe
File created	C:\Program Files\Windows Journal\Templates\e978f868350d50	Intoref.exe
File created	C:\Program Files\Microsoft Office\Office14\taskhost.exe	Intoref.exe
File created	C:\Program Files\Microsoft Office\Office14\b75386f1303e64	Intoref.exe
File created	C:\Program Files\Uninstall Information\wininit.exe	Intoref.exe
File created	C:\Program Files\Uninstall Information\56085415360792	Intoref.exe
File created	C:\Program Files\Windows Journal\Templates\powershell.exe	Intoref.exe
File created	C:\Program Files\Uninstall Information\csrss.exe	Intoref.exe

Drops file in Windows directory 7 IoCs

Processes:

wusa.exesvchost.exewusa.exeWMIADAP.EXEsppsvc.exe

description	ioc	process
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WMIADAP.EXE
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat	sppsvc.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2680 sc.exe
3184 sc.exe
3264 sc.exe
3256 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2680	sc.exe
3184	sc.exe
3264	sc.exe
3256	sc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1416	schtasks.exe
1648	schtasks.exe
2264	schtasks.exe
1984	schtasks.exe
1820	schtasks.exe
1496	schtasks.exe
1444	schtasks.exe
2268	schtasks.exe
380	schtasks.exe
1904	schtasks.exe
1540	schtasks.exe
300	schtasks.exe
1828	schtasks.exe
2980	schtasks.exe
916	schtasks.exe
2960	schtasks.exe
2360	schtasks.exe
952	schtasks.exe
2328	schtasks.exe
108	schtasks.exe
2152	schtasks.exe
2304	schtasks.exe
336	schtasks.exe
2060	schtasks.exe
2920	schtasks.exe
1312	schtasks.exe
268	schtasks.exe
1724	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4004 timeout.exe

pid	process
4004	timeout.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

powershell.exedialer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e05aaf024eacda01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Microsoft_crypt.exeIntoref.execsrss.exepowershell.exedialer.exelhhsgwktkatl.exepowershell.exedialer.exe

pid	process
2616	Microsoft_crypt.exe
1268	Intoref.exe
1268	Intoref.exe
1268	Intoref.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe
2448	powershell.exe
2584	csrss.exe
2616	Microsoft_crypt.exe
2616	Microsoft_crypt.exe
2616	Microsoft_crypt.exe
2616	Microsoft_crypt.exe
2616	Microsoft_crypt.exe
2616	Microsoft_crypt.exe
2616	Microsoft_crypt.exe
1684	dialer.exe
1684	dialer.exe
1684	dialer.exe
1684	dialer.exe
1684	dialer.exe
1684	dialer.exe
2584	csrss.exe
2616	Microsoft_crypt.exe
2616	Microsoft_crypt.exe
2616	Microsoft_crypt.exe
1684	dialer.exe
1684	dialer.exe
3432	lhhsgwktkatl.exe
2584	csrss.exe
3480	powershell.exe
1684	dialer.exe
1684	dialer.exe
1684	dialer.exe
1684	dialer.exe
2584	csrss.exe
3432	lhhsgwktkatl.exe
3432	lhhsgwktkatl.exe
3432	lhhsgwktkatl.exe
3432	lhhsgwktkatl.exe
3432	lhhsgwktkatl.exe
3432	lhhsgwktkatl.exe
3432	lhhsgwktkatl.exe
3432	lhhsgwktkatl.exe
3708	dialer.exe
3708	dialer.exe
2584	csrss.exe
3708	dialer.exe
3708	dialer.exe
2584	csrss.exe
2584	csrss.exe
2584	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

csrss.exeMicrosoft_R.exe

pid process

2584 csrss.exe
2324 Microsoft_R.exe

pid	process
2584	csrss.exe
2324	Microsoft_R.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Msvchost.exeIntoref.execsrss.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedialer.exepowercfg.exesvchost.exepowershell.exepowercfg.exepowercfg.exedialer.exepowercfg.exepowercfg.exedialer.exe

description	pid	process
Token: SeDebugPrivilege	2856	Msvchost.exe
Token: SeDebugPrivilege	1268	Intoref.exe
Token: SeDebugPrivilege	2856	Msvchost.exe
Token: SeDebugPrivilege	2584	csrss.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeShutdownPrivilege	1692	powercfg.exe
Token: SeShutdownPrivilege	2684	powercfg.exe
Token: SeShutdownPrivilege	2224	powercfg.exe
Token: SeDebugPrivilege	1684	dialer.exe
Token: SeShutdownPrivilege	2180	powercfg.exe
Token: SeAuditPrivilege	880	svchost.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeShutdownPrivilege	3676	powercfg.exe
Token: SeShutdownPrivilege	3652	powercfg.exe
Token: SeDebugPrivilege	3708	dialer.exe
Token: SeShutdownPrivilege	3660	powercfg.exe
Token: SeShutdownPrivilege	3668	powercfg.exe
Token: SeLockMemoryPrivilege	3836	dialer.exe
Token: SeAssignPrimaryTokenPrivilege	880	svchost.exe
Token: SeIncreaseQuotaPrivilege	880	svchost.exe
Token: SeSecurityPrivilege	880	svchost.exe
Token: SeTakeOwnershipPrivilege	880	svchost.exe
Token: SeLoadDriverPrivilege	880	svchost.exe
Token: SeSystemtimePrivilege	880	svchost.exe
Token: SeBackupPrivilege	880	svchost.exe
Token: SeRestorePrivilege	880	svchost.exe
Token: SeShutdownPrivilege	880	svchost.exe
Token: SeSystemEnvironmentPrivilege	880	svchost.exe
Token: SeUndockPrivilege	880	svchost.exe
Token: SeManageVolumePrivilege	880	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	880	svchost.exe
Token: SeIncreaseQuotaPrivilege	880	svchost.exe
Token: SeSecurityPrivilege	880	svchost.exe
Token: SeTakeOwnershipPrivilege	880	svchost.exe
Token: SeLoadDriverPrivilege	880	svchost.exe
Token: SeSystemtimePrivilege	880	svchost.exe
Token: SeBackupPrivilege	880	svchost.exe
Token: SeRestorePrivilege	880	svchost.exe
Token: SeShutdownPrivilege	880	svchost.exe
Token: SeSystemEnvironmentPrivilege	880	svchost.exe
Token: SeUndockPrivilege	880	svchost.exe
Token: SeManageVolumePrivilege	880	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	880	svchost.exe
Token: SeIncreaseQuotaPrivilege	880	svchost.exe
Token: SeSecurityPrivilege	880	svchost.exe
Token: SeTakeOwnershipPrivilege	880	svchost.exe
Token: SeLoadDriverPrivilege	880	svchost.exe
Token: SeSystemtimePrivilege	880	svchost.exe
Token: SeBackupPrivilege	880	svchost.exe
Token: SeRestorePrivilege	880	svchost.exe
Token: SeShutdownPrivilege	880	svchost.exe
Token: SeSystemEnvironmentPrivilege	880	svchost.exe
Token: SeUndockPrivilege	880	svchost.exe
Token: SeManageVolumePrivilege	880	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	880	svchost.exe
Token: SeIncreaseQuotaPrivilege	880	svchost.exe
Token: SeSecurityPrivilege	880	svchost.exe
Token: SeTakeOwnershipPrivilege	880	svchost.exe
Token: SeLoadDriverPrivilege	880	svchost.exe
Token: SeSystemtimePrivilege	880	svchost.exe
Token: SeBackupPrivilege	880	svchost.exe
Token: SeRestorePrivilege	880	svchost.exe
Token: SeShutdownPrivilege	880	svchost.exe
Token: SeSystemEnvironmentPrivilege	880	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Explorer.EXE

pid process

1100 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1100 Explorer.EXE
1100 Explorer.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

svchost.exe

pid process

880 svchost.exe

pid	process
1100	Explorer.EXE

pid	process
1100	Explorer.EXE
1100	Explorer.EXE

pid	process
880	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Vape.exeMicrosoft_Protection.exeMicrosoft_R.exeMicrosoft_M.exeMsvchost.exeWScript.execmd.exeIntoref.execmd.exeMicrosoft_crypt.execmd.exedialer.exe

description	pid	process	target process
PID 1568 wrote to memory of 2904	1568	Vape.exe	Microsoft_Protection.exe
PID 1568 wrote to memory of 2904	1568	Vape.exe	Microsoft_Protection.exe
PID 1568 wrote to memory of 2904	1568	Vape.exe	Microsoft_Protection.exe
PID 1568 wrote to memory of 2904	1568	Vape.exe	Microsoft_Protection.exe
PID 1568 wrote to memory of 2616	1568	Vape.exe	Microsoft_crypt.exe
PID 1568 wrote to memory of 2616	1568	Vape.exe	Microsoft_crypt.exe
PID 1568 wrote to memory of 2616	1568	Vape.exe	Microsoft_crypt.exe
PID 2904 wrote to memory of 2748	2904	Microsoft_Protection.exe	conhost.exe
PID 2904 wrote to memory of 2748	2904	Microsoft_Protection.exe	conhost.exe
PID 2904 wrote to memory of 2748	2904	Microsoft_Protection.exe	conhost.exe
PID 2904 wrote to memory of 2748	2904	Microsoft_Protection.exe	conhost.exe
PID 1568 wrote to memory of 2664	1568	Vape.exe	Microsoft_R.exe
PID 1568 wrote to memory of 2664	1568	Vape.exe	Microsoft_R.exe
PID 1568 wrote to memory of 2664	1568	Vape.exe	Microsoft_R.exe
PID 2664 wrote to memory of 2324	2664	Microsoft_R.exe	Microsoft_R.exe
PID 2664 wrote to memory of 2324	2664	Microsoft_R.exe	Microsoft_R.exe
PID 2664 wrote to memory of 2324	2664	Microsoft_R.exe	Microsoft_R.exe
PID 1568 wrote to memory of 2828	1568	Vape.exe	Microsoft_M.exe
PID 1568 wrote to memory of 2828	1568	Vape.exe	Microsoft_M.exe
PID 1568 wrote to memory of 2828	1568	Vape.exe	Microsoft_M.exe
PID 1568 wrote to memory of 2856	1568	Vape.exe	Msvchost.exe
PID 1568 wrote to memory of 2856	1568	Vape.exe	Msvchost.exe
PID 1568 wrote to memory of 2856	1568	Vape.exe	Msvchost.exe
PID 2828 wrote to memory of 2168	2828	Microsoft_M.exe	Microsoft_M.exe
PID 2828 wrote to memory of 2168	2828	Microsoft_M.exe	Microsoft_M.exe
PID 2828 wrote to memory of 2168	2828	Microsoft_M.exe	Microsoft_M.exe
PID 2856 wrote to memory of 2304	2856	Msvchost.exe	schtasks.exe
PID 2856 wrote to memory of 2304	2856	Msvchost.exe	schtasks.exe
PID 2856 wrote to memory of 2304	2856	Msvchost.exe	schtasks.exe
PID 2748 wrote to memory of 3004	2748	WScript.exe	cmd.exe
PID 2748 wrote to memory of 3004	2748	WScript.exe	cmd.exe
PID 2748 wrote to memory of 3004	2748	WScript.exe	cmd.exe
PID 2748 wrote to memory of 3004	2748	WScript.exe	cmd.exe
PID 3004 wrote to memory of 1268	3004	cmd.exe	Intoref.exe
PID 3004 wrote to memory of 1268	3004	cmd.exe	Intoref.exe
PID 3004 wrote to memory of 1268	3004	cmd.exe	Intoref.exe
PID 3004 wrote to memory of 1268	3004	cmd.exe	Intoref.exe
PID 1268 wrote to memory of 2668	1268	Intoref.exe	cmd.exe
PID 1268 wrote to memory of 2668	1268	Intoref.exe	cmd.exe
PID 1268 wrote to memory of 2668	1268	Intoref.exe	cmd.exe
PID 2668 wrote to memory of 2104	2668	cmd.exe	w32tm.exe
PID 2668 wrote to memory of 2104	2668	cmd.exe	w32tm.exe
PID 2668 wrote to memory of 2104	2668	cmd.exe	w32tm.exe
PID 2668 wrote to memory of 2584	2668	cmd.exe	csrss.exe
PID 2668 wrote to memory of 2584	2668	cmd.exe	csrss.exe
PID 2668 wrote to memory of 2584	2668	cmd.exe	csrss.exe
PID 2616 wrote to memory of 1684	2616	Microsoft_crypt.exe	dialer.exe
PID 2616 wrote to memory of 1684	2616	Microsoft_crypt.exe	dialer.exe
PID 2616 wrote to memory of 1684	2616	Microsoft_crypt.exe	dialer.exe
PID 2616 wrote to memory of 1684	2616	Microsoft_crypt.exe	dialer.exe
PID 2616 wrote to memory of 1684	2616	Microsoft_crypt.exe	dialer.exe
PID 2616 wrote to memory of 1684	2616	Microsoft_crypt.exe	dialer.exe
PID 2616 wrote to memory of 1684	2616	Microsoft_crypt.exe	dialer.exe
PID 272 wrote to memory of 1012	272	cmd.exe	wusa.exe
PID 272 wrote to memory of 1012	272	cmd.exe	wusa.exe
PID 272 wrote to memory of 1012	272	cmd.exe	wusa.exe
PID 1684 wrote to memory of 436	1684	dialer.exe	winlogon.exe
PID 1684 wrote to memory of 480	1684	dialer.exe	services.exe
PID 1684 wrote to memory of 496	1684	dialer.exe	lsass.exe
PID 1684 wrote to memory of 504	1684	dialer.exe	lsm.exe
PID 1684 wrote to memory of 616	1684	dialer.exe	svchost.exe
PID 1684 wrote to memory of 688	1684	dialer.exe	svchost.exe
PID 1684 wrote to memory of 776	1684	dialer.exe	svchost.exe
PID 1684 wrote to memory of 836	1684	dialer.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Loads dropped DLL
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:616

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
3⤵
- Checks processor information in registry
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Journal\Templates\powershell.exe'" /f
4⤵
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\Templates\powershell.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\Templates\powershell.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /f
4⤵
- Creates scheduled task(s)
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_cryptM" /sc MINUTE /mo 13 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\Microsoft_crypt.exe'" /f
4⤵
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_crypt" /sc ONLOGON /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\Microsoft_crypt.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_cryptM" /sc MINUTE /mo 7 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\Microsoft_crypt.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office14\taskhost.exe'" /f
4⤵
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\taskhost.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\taskhost.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\wininit.exe'" /f
4⤵
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\wininit.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\wininit.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_MM" /sc MINUTE /mo 5 /tr "'C:\Webdriversession\Microsoft_M.exe'" /f
4⤵
- Creates scheduled task(s)
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_M" /sc ONLOGON /tr "'C:\Webdriversession\Microsoft_M.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_MM" /sc MINUTE /mo 7 /tr "'C:\Webdriversession\Microsoft_M.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe'" /f
4⤵
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
4⤵
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe'" /f
4⤵
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe'" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
3⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
- Modifies security service
- Drops file in System32 directory
PID:776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:836

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
3⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:880

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1160

C:\Windows\system32\taskeng.exe
taskeng.exe {6D722C07-08F9-42BA-A7BB-21C3CDE3A281} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
3⤵
PID:1200

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:1516

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:4056

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:3296

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:2480

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
4⤵
- Executes dropped EXE
PID:3240

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:960

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe
4⤵
- Executes dropped EXE
PID:596

C:\Program Files\Microsoft Office\Office14\taskhost.exe
"C:\Program Files\Microsoft Office\Office14\taskhost.exe"
4⤵
- Executes dropped EXE
PID:2488

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe
"C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe"
4⤵
- Executes dropped EXE
PID:4984

C:\Webdriversession\Microsoft_M.exe
C:\Webdriversession\Microsoft_M.exe
4⤵
- Executes dropped EXE
PID:5024

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
4⤵
- Executes dropped EXE
PID:5348

C:\Program Files\Windows Journal\Templates\powershell.exe
"C:\Program Files\Windows Journal\Templates\powershell.exe"
4⤵
- Executes dropped EXE
PID:5380

C:\Program Files\Uninstall Information\wininit.exe
"C:\Program Files\Uninstall Information\wininit.exe"
4⤵
- Executes dropped EXE
PID:5420

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe
4⤵
- Executes dropped EXE
PID:5980

C:\Program Files\Microsoft Office\Office14\taskhost.exe
"C:\Program Files\Microsoft Office\Office14\taskhost.exe"
4⤵
- Executes dropped EXE
PID:6020

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\Microsoft_crypt.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\Microsoft_crypt.exe
4⤵
- Executes dropped EXE
PID:6496

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe
"C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe"
4⤵
- Executes dropped EXE
PID:6644

C:\Webdriversession\Microsoft_M.exe
C:\Webdriversession\Microsoft_M.exe
4⤵
- Executes dropped EXE
PID:6708

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
4⤵
- Executes dropped EXE
PID:6292

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe
4⤵
- Executes dropped EXE
PID:7464

C:\Program Files\Microsoft Office\Office14\taskhost.exe
"C:\Program Files\Microsoft Office\Office14\taskhost.exe"
4⤵
- Executes dropped EXE
PID:7548

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
4⤵
- Executes dropped EXE
PID:8656

C:\Program Files\Uninstall Information\wininit.exe
"C:\Program Files\Uninstall Information\wininit.exe"
4⤵
- Executes dropped EXE
PID:8696

C:\Program Files\Windows Journal\Templates\powershell.exe
"C:\Program Files\Windows Journal\Templates\powershell.exe"
4⤵
- Executes dropped EXE
PID:8764

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe
"C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe"
4⤵
- Executes dropped EXE
PID:8236

C:\Webdriversession\Microsoft_M.exe
C:\Webdriversession\Microsoft_M.exe
4⤵
- Executes dropped EXE
PID:8700

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\lsm.exe
4⤵
- Executes dropped EXE
PID:10192

C:\Program Files\Microsoft Office\Office14\taskhost.exe
"C:\Program Files\Microsoft Office\Office14\taskhost.exe"
4⤵
- Executes dropped EXE
PID:10212

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\System.exe
4⤵
- Executes dropped EXE
PID:10428

C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\Microsoft_crypt.exe
C:\Recovery\3e6c2342-cc12-11ee-878b-7662d560f583\Microsoft_crypt.exe
4⤵
- Executes dropped EXE
PID:10684

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe
"C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe"
4⤵
- Executes dropped EXE
PID:11276

C:\Webdriversession\Microsoft_M.exe
C:\Webdriversession\Microsoft_M.exe
4⤵
- Executes dropped EXE
PID:11304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:304

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:1108

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:3048

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
- Drops file in Windows directory
PID:2336

C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3432

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:3644

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
- Drops file in Windows directory
PID:3824

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
3⤵
PID:3760

C:\Windows\system32\dialer.exe
dialer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
2⤵
PID:2516

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:496

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:504

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1100

C:\Users\Admin\AppData\Local\Temp\Vape.exe
"C:\Users\Admin\AppData\Local\Temp\Vape.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Webdriversession\gI2DkJwTD.vbe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Webdriversession\SoPkc.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004

C:\Webdriversession\Intoref.exe
"C:\Webdriversession\Intoref.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0b5bJMXlig.bat"
7⤵
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:2104

C:\Program Files\Uninstall Information\csrss.exe
"C:\Program Files\Uninstall Information\csrss.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
4⤵
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
5⤵
- Drops file in Windows directory
PID:1012

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "QHRAJGDI"
4⤵
- Launches sc.exe
PID:2680

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"
4⤵
- Launches sc.exe
PID:3184

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
4⤵
- Launches sc.exe
PID:3256

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "QHRAJGDI"
4⤵
- Launches sc.exe
PID:3264

C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2324

C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828

C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168

C:\Users\Admin\AppData\Local\Temp\Msvchost.exe
"C:\Users\Admin\AppData\Local\Temp\Msvchost.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft_WindowsDefender" /tr "C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe"
4⤵
- Creates scheduled task(s)
PID:2304

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /delete /f /tn "Microsoft_WindowsDefender"
4⤵
PID:2796

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpBAC7.tmp.bat""
4⤵
PID:2228

C:\Windows\system32\timeout.exe
timeout 3
5⤵
- Delays execution with timeout.exe
PID:4004

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "90651604931263386-253908425-1051539239-5875627231099718192-763278728-1538316902"
1⤵
PID:2192

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3988733951295589223105707911117443152391869964309-4349980575918090061574059864"
1⤵
PID:2144

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3611393811727735571757090607-20637147671910144652-1339044541-2024391573-1374359495"
1⤵
PID:1616

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14861474282112001560643375140-719409071-2061515606-2006394853244836254-1886162485"
1⤵
PID:1628

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-970271716-1874521241-1979711257-6228417948779439948589502671667766793-1891645103"
1⤵
PID:2748

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1820713100-699725176-251489274-10090615381027854858-1901771608-15196473841268847823"
1⤵
PID:3272

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "341936545729213766-13841989501251923166-5295866589403294061545868719-491030657"
1⤵
PID:3280

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1893352751-1495418998-946045418-1229767407-892719152-165575445611696566961190140312"
1⤵
PID:3488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1118647792-1367288664-4462228741248722101404406235-825867547-20188369902122374121"
1⤵
PID:3684

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19699996931727166953-9080857700042760-1310452131-4301601541023458268652340318"
1⤵
PID:3732

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "676973638-66849301142435551020376401056983215861888663065991954059-43370803"
1⤵
PID:3748

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1723836170-12106664751721926695-633736552-15245339341254595260-13330709661718146793"
1⤵
PID:3348

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1397169329-811176352-1837804850-3150978471463766829237298358227165401987120306"
1⤵
PID:3784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry