njrat | ac23fc53a20f5a19e8183bfba89bcf040d64bec45628c8f50fd80d13d4641081

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe

Loads dropped DLL 2 IoCs

pid	Process
416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe
416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/416-7-0x0000000000400000-0x0000000000D1D000-memory.dmp	themida
behavioral2/memory/416-27-0x0000000000400000-0x0000000000D1D000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/416-8-0x0000000066000000-0x000000006618C000-memory.dmp	upx
behavioral2/memory/416-9-0x0000000066000000-0x000000006618C000-memory.dmp	upx
behavioral2/memory/416-12-0x0000000066000000-0x000000006618C000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 416 set thread context of 1324	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	137
PID 416 set thread context of 1340	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	155

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe
416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe
Token: 33	1340	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1340	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 988	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	86
PID 416 wrote to memory of 988	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	86
PID 416 wrote to memory of 988	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	86
PID 416 wrote to memory of 4016	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	88
PID 416 wrote to memory of 4016	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	88
PID 416 wrote to memory of 4016	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	88
PID 416 wrote to memory of 2400	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	89
PID 416 wrote to memory of 2400	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	89
PID 416 wrote to memory of 2400	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	89
PID 416 wrote to memory of 5056	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	90
PID 416 wrote to memory of 5056	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	90
PID 416 wrote to memory of 5056	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	90
PID 416 wrote to memory of 4960	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	91
PID 416 wrote to memory of 4960	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	91
PID 416 wrote to memory of 4960	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	91
PID 416 wrote to memory of 4364	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	92
PID 416 wrote to memory of 4364	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	92
PID 416 wrote to memory of 4364	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	92
PID 416 wrote to memory of 1848	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	93
PID 416 wrote to memory of 1848	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	93
PID 416 wrote to memory of 1848	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	93
PID 416 wrote to memory of 5016	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	94
PID 416 wrote to memory of 5016	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	94
PID 416 wrote to memory of 5016	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	94
PID 416 wrote to memory of 3808	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	95
PID 416 wrote to memory of 3808	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	95
PID 416 wrote to memory of 3808	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	95
PID 416 wrote to memory of 4728	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	96
PID 416 wrote to memory of 4728	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	96
PID 416 wrote to memory of 4728	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	96
PID 416 wrote to memory of 4964	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	97
PID 416 wrote to memory of 4964	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	97
PID 416 wrote to memory of 4964	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	97
PID 416 wrote to memory of 4984	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	98
PID 416 wrote to memory of 4984	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	98
PID 416 wrote to memory of 4984	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	98
PID 416 wrote to memory of 1776	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	99
PID 416 wrote to memory of 1776	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	99
PID 416 wrote to memory of 1776	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	99
PID 416 wrote to memory of 2244	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	100
PID 416 wrote to memory of 2244	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	100
PID 416 wrote to memory of 2244	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	100
PID 416 wrote to memory of 4108	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	101
PID 416 wrote to memory of 4108	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	101
PID 416 wrote to memory of 4108	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	101
PID 416 wrote to memory of 5084	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	102
PID 416 wrote to memory of 5084	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	102
PID 416 wrote to memory of 5084	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	102
PID 416 wrote to memory of 4204	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	103
PID 416 wrote to memory of 4204	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	103
PID 416 wrote to memory of 4204	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	103
PID 416 wrote to memory of 548	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	104
PID 416 wrote to memory of 548	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	104
PID 416 wrote to memory of 548	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	104
PID 416 wrote to memory of 3468	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	105
PID 416 wrote to memory of 3468	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	105
PID 416 wrote to memory of 3468	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	105
PID 416 wrote to memory of 4060	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	106
PID 416 wrote to memory of 4060	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	106
PID 416 wrote to memory of 4060	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	106
PID 416 wrote to memory of 3588	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	107
PID 416 wrote to memory of 3588	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	107
PID 416 wrote to memory of 3588	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	107
PID 416 wrote to memory of 4556	416	74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe	108

C:\Users\Admin\AppData\Local\Temp\74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\74b00da0f2e4d0c8b6e2875d02fefcecJaffaCakes118_NeikiAnalytics.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /TN REV_2611 /TR "'C:\Users\Admin\AppData\Roaming\{IQF2-5DU2-76KQ-KELJ-8649-TMI9}\REV_S8L8V.exe' /Installed" /sc ONLOGON /RL HIGHEST /F
  2⤵
  - Creates scheduled task(s)
  PID:988
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4016
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2400
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:5056
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4960
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4364
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1848
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:5016
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3808
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4728
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4964
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4984
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2244
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4108
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:5084
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4204
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:548
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3468
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4060
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3588
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4556
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3240
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3764
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:452
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:768
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4864
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4836
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4872
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1032
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3056
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2820
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:656
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2772
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4504
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1732
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:884
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1164
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2892
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1704
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4444
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2836
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2952
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4116
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4196
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3200
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1324
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3868
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3784
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4032
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2128
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3668
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4240
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:5088
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:3496
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4144
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:4716
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:1456
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

System Information Discovery