stormkitty | dce4f486acb10ec17770782fada8e7696d454727912a2889ebfbf466c9bbb60e

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2912-1178-0x000000001D4A0000-0x000000001D5C0000-memory.dmp	family_stormkitty

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/1724-1168-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1724-1169-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1724-1166-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1724-1165-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1724-1170-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1724-1173-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1724-1172-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1724-1177-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1724-1176-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2276	powershell.exe
984	powershell.exe
1216	powershell.exe
2696	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\YWZWALUU\ImagePath = "C:\\ProgramData\\bbskkvrqdoji\\fdjrmaypnxal.exe"	services.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk	RuntimeBroker.exe

Executes dropped EXE 12 IoCs

pid	Process
2200	Lunar Release.exe
2656	svchost.exe
2912	RuntimeBroker.exe
2824	num2.EXE
624	jhi_service.exe
2756	voltlunars.exe
880	lunar.exe
2192	MicrosoftEdgeUpdater.exe
472	services.exe
2668	kanilzbpgdul.exe
876	fdjrmaypnxal.exe
1732	fdjrmaypnxal.exe

Loads dropped DLL 16 IoCs

pid	Process
2184	Lunar Release V1.2.exe
796	conhost.exe
2184	Lunar Release V1.2.exe
2184	Lunar Release V1.2.exe
2184	Lunar Release V1.2.exe
2824	num2.EXE
2824	num2.EXE
2656	svchost.exe
2756	voltlunars.exe
2200	Lunar Release.exe
880	lunar.exe
2824	num2.EXE
2824	num2.EXE
472	services.exe
472	services.exe
472	services.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-1161-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1168-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1169-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1166-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1165-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1164-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1163-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1162-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1160-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1170-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1173-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1172-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1177-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1724-1176-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	num2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\AMD Graphics Manager = "C:\\Users\\Admin\\AppData\\Roaming\\AMD Graphics Manager"	RuntimeBroker.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	fdjrmaypnxal.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	fdjrmaypnxal.exe
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File opened for modification	C:\Windows\system32\MRT.exe	MicrosoftEdgeUpdater.exe
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	svchost.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2668 set thread context of 2560	2668	kanilzbpgdul.exe	58
PID 2668 set thread context of 1724	2668	kanilzbpgdul.exe	63
PID 2192 set thread context of 1500	2192	MicrosoftEdgeUpdater.exe	90
PID 876 set thread context of 2284	876	fdjrmaypnxal.exe	120
PID 876 set thread context of 556	876	fdjrmaypnxal.exe	123
PID 876 set thread context of 1752	876	fdjrmaypnxal.exe	126
PID 1732 set thread context of 1492	1732	fdjrmaypnxal.exe	151
PID 1732 set thread context of 2928	1732	fdjrmaypnxal.exe	156

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WMIADAP.EXE
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe

Launches sc.exe 23 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2344	sc.exe
2784	sc.exe
288	sc.exe
464	sc.exe
2260	sc.exe
1740	sc.exe
1696	sc.exe
1096	sc.exe
300	sc.exe
592	sc.exe
876	sc.exe
584	sc.exe
2480	sc.exe
2796	sc.exe
2480	sc.exe
1224	sc.exe
2892	sc.exe
1520	sc.exe
440	sc.exe
1340	sc.exe
1124	sc.exe
1848	sc.exe
2776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2288	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 9056672802b5da01	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
624	jhi_service.exe
624	jhi_service.exe
624	jhi_service.exe
624	jhi_service.exe
624	jhi_service.exe
624	jhi_service.exe
624	jhi_service.exe
624	jhi_service.exe
2668	kanilzbpgdul.exe
2668	kanilzbpgdul.exe
2668	kanilzbpgdul.exe
2668	kanilzbpgdul.exe
2668	kanilzbpgdul.exe
2668	kanilzbpgdul.exe
2192	MicrosoftEdgeUpdater.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe
1500	dialer.exe
1500	dialer.exe
1500	dialer.exe
1500	dialer.exe
2192	MicrosoftEdgeUpdater.exe
1500	dialer.exe
1500	dialer.exe
2192	MicrosoftEdgeUpdater.exe
2192	MicrosoftEdgeUpdater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	632	powercfg.exe
Token: SeShutdownPrivilege	660	powercfg.exe
Token: SeShutdownPrivilege	2284	powercfg.exe
Token: SeShutdownPrivilege	984	powercfg.exe
Token: SeDebugPrivilege	2912	RuntimeBroker.exe
Token: SeShutdownPrivilege	2524	powercfg.exe
Token: SeShutdownPrivilege	2516	powercfg.exe
Token: SeShutdownPrivilege	2784	powercfg.exe
Token: SeShutdownPrivilege	2544	powercfg.exe
Token: SeLockMemoryPrivilege	1724	svchost.exe
Token: SeShutdownPrivilege	2296	powercfg.exe
Token: SeShutdownPrivilege	980	powercfg.exe
Token: SeDebugPrivilege	1500	dialer.exe
Token: SeShutdownPrivilege	1620	powercfg.exe
Token: SeShutdownPrivilege	1900	powercfg.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeDebugPrivilege	2748	wmiprvse.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeAuditPrivilege	848	svchost.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	2284	dialer.exe
Token: SeShutdownPrivilege	2120	powercfg.exe
Token: SeShutdownPrivilege	2448	powercfg.exe
Token: SeShutdownPrivilege	2704	powercfg.exe
Token: SeShutdownPrivilege	2608	powercfg.exe
Token: SeAuditPrivilege	848	svchost.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2200	2184	Lunar Release V1.2.exe	28
PID 2184 wrote to memory of 2200	2184	Lunar Release V1.2.exe	28
PID 2184 wrote to memory of 2200	2184	Lunar Release V1.2.exe	28
PID 2184 wrote to memory of 2200	2184	Lunar Release V1.2.exe	28
PID 2184 wrote to memory of 2656	2184	Lunar Release V1.2.exe	30
PID 2184 wrote to memory of 2656	2184	Lunar Release V1.2.exe	30
PID 2184 wrote to memory of 2656	2184	Lunar Release V1.2.exe	30
PID 2184 wrote to memory of 2656	2184	Lunar Release V1.2.exe	30
PID 2184 wrote to memory of 2912	2184	Lunar Release V1.2.exe	31
PID 2184 wrote to memory of 2912	2184	Lunar Release V1.2.exe	31
PID 2184 wrote to memory of 2912	2184	Lunar Release V1.2.exe	31
PID 2184 wrote to memory of 2912	2184	Lunar Release V1.2.exe	31
PID 2184 wrote to memory of 2824	2184	Lunar Release V1.2.exe	32
PID 2184 wrote to memory of 2824	2184	Lunar Release V1.2.exe	32
PID 2184 wrote to memory of 2824	2184	Lunar Release V1.2.exe	32
PID 2184 wrote to memory of 2824	2184	Lunar Release V1.2.exe	32
PID 2824 wrote to memory of 624	2824	num2.EXE	33
PID 2824 wrote to memory of 624	2824	num2.EXE	33
PID 2824 wrote to memory of 624	2824	num2.EXE	33
PID 2656 wrote to memory of 2756	2656	svchost.exe	34
PID 2656 wrote to memory of 2756	2656	svchost.exe	34
PID 2656 wrote to memory of 2756	2656	svchost.exe	34
PID 2200 wrote to memory of 880	2200	Lunar Release.exe	35
PID 2200 wrote to memory of 880	2200	Lunar Release.exe	35
PID 2200 wrote to memory of 880	2200	Lunar Release.exe	35
PID 2824 wrote to memory of 2192	2824	num2.EXE	52
PID 2824 wrote to memory of 2192	2824	num2.EXE	52
PID 2824 wrote to memory of 2192	2824	num2.EXE	52
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 2560	2668	kanilzbpgdul.exe	58
PID 2668 wrote to memory of 1724	2668	kanilzbpgdul.exe	63
PID 2668 wrote to memory of 1724	2668	kanilzbpgdul.exe	63
PID 2668 wrote to memory of 1724	2668	kanilzbpgdul.exe	63
PID 2668 wrote to memory of 1724	2668	kanilzbpgdul.exe	63
PID 2668 wrote to memory of 1724	2668	kanilzbpgdul.exe	63
PID 2912 wrote to memory of 2288	2912	RuntimeBroker.exe	66
PID 2912 wrote to memory of 2288	2912	RuntimeBroker.exe	66
PID 2912 wrote to memory of 2288	2912	RuntimeBroker.exe	66
PID 672 wrote to memory of 1616	672	cmd.exe	74
PID 672 wrote to memory of 1616	672	cmd.exe	74
PID 672 wrote to memory of 1616	672	cmd.exe	74
PID 2192 wrote to memory of 1500	2192	MicrosoftEdgeUpdater.exe	90
PID 2192 wrote to memory of 1500	2192	MicrosoftEdgeUpdater.exe	90
PID 2192 wrote to memory of 1500	2192	MicrosoftEdgeUpdater.exe	90
PID 2192 wrote to memory of 1500	2192	MicrosoftEdgeUpdater.exe	90
PID 2192 wrote to memory of 1500	2192	MicrosoftEdgeUpdater.exe	90
PID 2192 wrote to memory of 1500	2192	MicrosoftEdgeUpdater.exe	90
PID 2192 wrote to memory of 1500	2192	MicrosoftEdgeUpdater.exe	90
PID 1500 wrote to memory of 428	1500	dialer.exe	5
PID 1500 wrote to memory of 472	1500	dialer.exe	6
PID 1500 wrote to memory of 488	1500	dialer.exe	7
PID 1500 wrote to memory of 496	1500	dialer.exe	8
PID 1500 wrote to memory of 596	1500	dialer.exe	9
PID 1500 wrote to memory of 676	1500	dialer.exe	10
PID 1500 wrote to memory of 748	1500	dialer.exe	11
PID 1500 wrote to memory of 812	1500	dialer.exe	12
PID 1500 wrote to memory of 848	1500	dialer.exe	13

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
PID:472
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
    3⤵
    PID:2400
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Modifies security service
  - Drops file in System32 directory
  PID:748
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1152
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:848
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {60AF52A3-B882-48B0-84B3-2B137F58E80E} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
    3⤵
    PID:2132
- - C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1096
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:960
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:276
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1004
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1072
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1080
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1288
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2148
- C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe
  C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\system32\conhost.exe
    C:\Windows\system32\conhost.exe
    3⤵
    PID:2560
- - C:\Windows\system32\svchost.exe
    svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe
  C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  PID:876
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1524
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:1516
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1696
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1096
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:300
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2260
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1340
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      PID:1216
  - - C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe
      "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      PID:1732
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:2696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2544
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Drops file in Windows directory
        
        PID:1776
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:2344
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:592
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:2480
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:2784
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:1224
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        
        PID:1572
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        
        PID:1980
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        
        PID:1608
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        
        PID:2604
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        
        PID:1492
    - - C:\Windows\system32\dialer.exe
        
        dialer.exe
        5⤵
        
        PID:2928
- - C:\Windows\system32\dialer.exe
    dialer.exe
    3⤵
    PID:1752

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:488

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:496

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\Lunar Release V1.2.exe
  "C:\Users\Admin\AppData\Local\Temp\Lunar Release V1.2.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Lunar Release.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunar Release.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\onefile_2200_133618159454974000\lunar.exe
      "C:\Users\Admin\AppData\Local\Temp\Lunar Release.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:880
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\onefile_2656_133618159467922000\voltlunars.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2756
- - C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AMD Graphics Manager" /tr "C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"
      4⤵
      Creates scheduled task(s)
      PID:2288
- - C:\Users\Admin\AppData\Local\Temp\num2.EXE
    "C:\Users\Admin\AppData\Local\Temp\num2.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:624
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:632
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:984
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:660
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "HDNFMUHS"
        5⤵
        Launches sc.exe
        
        PID:2892
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:1520
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:288
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "HDNFMUHS"
        5⤵
        Launches sc.exe
        
        PID:876
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:672
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Drops file in Windows directory
        
        PID:1616
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:1124
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:1848
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:584
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:2480
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:440
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:980
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1500
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "YWZWALUU"
        5⤵
        Launches sc.exe
        
        PID:464
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:1740
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:2776
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "YWZWALUU"
        5⤵
        Launches sc.exe
        
        PID:2796

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1343249907-171217285210882730637908535381668521381137692256715399350191746704164"
1⤵
- Loads dropped DLL
PID:796

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "728616332-1508624491-2105728856-1635742401215972980109285635791063436-196720959"
1⤵
PID:2396

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "716937809-1220419174-106716984914733976695342457991068414270-2118471432-31168039"
1⤵
PID:3056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-707584949-122279000912407688101366278530-16572969773615932-1441006794-58769339"
1⤵
PID:284

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1646358863313039346-900646886-2061864090-1497814767-1313000831-1001689202767736076"
1⤵
PID:2908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2130183239-160621774020680081451371785598-701990574-97663594192106159-1700596954"
1⤵
PID:352

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1840771804485246156-79925824-13299438821473527903-298961080-3529222641922052901"
1⤵
PID:2032

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1478245489-19910734511018495381666636408246408043-14835817011159432515606793209"
1⤵
PID:2672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1709668992-577831971-1880923366-5569142684083881111632966740-9672509331177307"
1⤵
PID:2904

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1540820601211845890-124121341170112628-144065340714151512831360365024736704110"
1⤵
PID:2652

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1172428827-5347938632138488677-1198686446-1366150029-1233397453-911318752626925460"
1⤵
PID:1912

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-102585819-1873886949-16272021462029021466-2100912866-94336815018634132831542386073"
1⤵
PID:2472

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-20554437391458570885-1762681193-1820624559786280830-1692667851-89747874-1693743974"
1⤵
PID:1764

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-548595709-153970656945430331234031152-3899596453542062521378081510-1227359555"
1⤵
PID:1672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9640141903007379143967674271939878157-52298684778740666-1100530036528563073"
1⤵
PID:1580

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-527526041344726092107706577-19808726701674338387-195972455752580904-2146144066"
1⤵
PID:2804

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "29774946522906195919365368755103233317036958731529707665-1835062666-1266310318"
1⤵
PID:1292

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-458052694-722862556-988253155153870203011696427011591343307-907127625-1060889025"
1⤵
PID:3056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-883918187-94560200995104485318685743871496217376-642750185-1124228757-1556790515"
1⤵
PID:828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1285942034555945115-130200405511843257052139870803-539279195-405861661426855899"
1⤵
PID:1620

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "409072003-1256626620-775038091-103911526018307593951662389756-775371369249712419"
1⤵
PID:760

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-97630631231937912913130482951232293637-252358060-844284509-600569798-1814851032"
1⤵
PID:1664

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "42312434013602423562006414447-965149207-135042512-78205687012985176511431423592"
1⤵
PID:1996

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1449607296-1084424704-84037662371684806-1226930202-956857588926442625157391075"
1⤵
PID:1744

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1527350681-196731124621553659921343889-982294227-468524507-401344732-310757987"
1⤵
PID:2100

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "884892373-172412100-4522874512135655938-1536748114-828712825-313022326-1105684477"
1⤵
PID:552

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "141688097610874170412124698067-376920538408746888-1508434041-1592622434-1822910660"
1⤵
PID:2096

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "21325354887928515881404900341957109495700364637-882909391-21421437411344278658"
1⤵
PID:2332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-163547144620281536151279802053-55726066-2065805163-10653582751382257887-1282057821"
1⤵
PID:984

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "785903000411430279-1338924559-1569767850135581851066764328-20515932911298944485"
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry